HI
I want to use | metadata commend to display sourcetype host and sources at the same time, so far I cant make connection between them.
As we know when I run | metadata type=sourcetypes search it will return me sourcetype information,like below
firstTime lastTime recentTime sourcetype totalCount type
151572 1515399 152170 RT2RO 108 sourcetypes
the output I am looking for is
firstTime lastTime recentTime sourcetype totalCount source host
151572 1515399 152170 RT2RO 108 \var\log\a rt2.server.com
Can this be done using | metadata command?
The reason I want to use it is just because it give result fast 🙂
Thanks in advance
hello there,
not sure how to achieve with | metadata
(without | append
or | appendcols
) but give ashot to the next search:
|tstats count as event_count min(_time) as firstTime max(_time) as lastTime by host source sourcetype where index=*
hope it helps
hello there,
not sure how to achieve with | metadata
(without | append
or | appendcols
) but give ashot to the next search:
|tstats count as event_count min(_time) as firstTime max(_time) as lastTime by host source sourcetype where index=*
hope it helps
Thanks Adonio, not very familiar with tstats but it got what I want thanks again.