Parser usage poll.

[sbylica-splunk]

Hi, we created a poll to measure the usage of various parsers, please take a minute to respond and help us improve SC4S!

https://docs.google.com/forms/d/e/1FAIpQLSeXcCwHdlsqfixlm2WeMuMUll54K9sE6RIYjcuFUYm2ZbVxMw/viewform

Thanks, SC4S team.

[zyphermonkey]

By chance is there a splunk search we can run to accurately capture this data?

[mstopa-splunk]

@zyphermonkey thank you for your response, see this:

| tstats count where index=* by sc4s_tags | eval tags=split(sc4s_tags,"|") | mvexpand tags | search tags=".app.*" | stats sum(count) as eventCount by tags | sort - eventCount