Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I write a search to get 3 events for each eventcode form windows events?

$
0
0
I am running the following query to get events from windows event logs for the past month. I want to restrict the search to extract only first 3 events for each event code. Any pointers please? index=xxxx sourcetype=yyyy host=zzzz | table _time,host,EventCode,EventCodeDescription,_raw Required output: EventCode1 EventCode1 EventCode1 EventCode2 EventCode2 EventCode2 EventCode3 EventCode3 EventCode3 . . .

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>