All | inputlookup windows_event_system | dedup Host | sort Host Host Host * -15m now
Total Crashes By Host eventtype="wineventlog_common" EventCode="1001" Event_Name="*" host="$EventHost$" | eval application=P1 | stats sparkline as Trend, count by host | sort -count $Time.earliest$ $Time.latest$
Total Crashes By Application eventtype="wineventlog_common" EventCode="1001" Event_Name="*" host="$EventHost$" | eval application=P1." (version: ".P2.")" | stats sparkline as Trend, count by application | sort -count $Time.earliest$ $Time.latest$
Crashes Over Time By Host eventtype="wineventlog_common" EventCode="1001" Event_Name="*" host="$EventHost$" | timechart count by host useother=f $Time.earliest$ $Time.latest$ Crashes Over Time By Application eventtype="wineventlog_common" EventCode="1001" Event_Name="*" host="$EventHost$" | eval application=P1." (version: ".P2.")" | timechart count by application useother=f $Time.earliest$ $Time.latest$ Crashes Details By Host eventtype="wineventlog_common" EventCode="1001" Event_Name="*" host="$EventHost$" | eval application=P1." (version: ".P2.")" | stats latest(_time) as ltime, count by host, application | convert ctime(ltime) | eval comb=application." (Total App Events = ".count." )(Last Crash Time = ".ltime." )" | stats values(comb) AS Applications, sum(count) AS Total_Events by host | sort -Total_Events $Time.earliest$ $Time.latest$

More reports