topic list common uid on two hosts in Deployment Architecture

list common uid on two hosts

nikkuu — Fri, 27 Jan 2017 03:33:10 GMT

I am trying to list out common uid on two different hosts.
I am using this but this give a visual of all uids including the common ones.
sourcetype=access $host1$ OR $host2$ error=2*| chart max(O) over host by uid

Re: list common uid on two hosts

snoobzilla — Fri, 27 Jan 2017 18:27:37 GMT

Eventstats should work, though not terribly efficient...

sourcetype=access $host1$ OR $host2$ error=2*
| eventstats dc(host) AS hosts by uid
| search hosts>1
| chart max(O) over host by uid

Re: list common uid on two hosts

somesoni2 — Fri, 27 Jan 2017 20:06:08 GMT

It will depend a lot on what's your final output should be. If you just want to know list of uid which are on both hosts, you could do like this

sourcetype=access $host1$ OR $host2$ error=2* | stats dc(host) as host_count by uid | where host_count=2

If you want list hosts as well,

sourcetype=access $host1$ OR $host2$ error=2*| chart dc(uid) over host by uid | addtotals | where Total=2