Click on the event source to check it on www.eventid.net
-24h@h now Error ( ) Type=" " OR `event_sources`| stats count by Type $earliest$ $latest$ Type Type All * ( ) ComputerName=" " OR `event_sources` | stats count by ComputerName $earliest$ $latest$ ComputerName ComputerName *
Event sources Click on the source to look it up on www.eventid.net `event_sources` $Type$ AND $Computer$ AND $keyword$ | stats count as TotalEvents by SourceName https://www.eventid.net/source-name-$row.SourceName$.htm Event sources percentages `event_sources` $Type$ AND $Computer$ AND $keyword$ | stats count by SourceName Matching events - drill down option `event_sources` $Type$ AND $Computer$ AND $keyword$| table _time, ComputerName, LogName, EventCode, SourceName, Type, Message, UserName ["ComputerName","LogName","EventCode","SourceName","Type","Message","UserName"]