list all event ids found by each device

  • 30 October 2023
  • 1 reply

I need to create a query to export the results with the following criteria, but unsure how to write the query.

I want to list every end device by hostname (including all end devices fed by Windows event collectors, not reported as the WEC) and then all the event codes (unique) collected from that device in ascending order.


Can someone please point me in the right direction

1 reply

Userlevel 3
Badge +3

Hi Mark,

Could this search query help you?

norm_id = winserver event_id = * host = *| chart count() by event_id, host order by event_id asc limit 1000


Best Regards,