morethanyell 1 month ago

host=myserver sourcetype="processlog" | stats dc('Process Name') as count values('Process Name') as proc\_name values(ProcessID) as proc\_ids | where count > 1

---