topic Re: Report Showing How Many Hosts Per Index in Reporting

Report Showing How Many Hosts Per Index

aferone — Thu, 16 May 2013 15:42:17 GMT

I have been trying, but I can't get it to work.

I basically want a table that shows the index in Column A, and how many hosts are in that index in Column B. How would I go about this?

Thanks!

bmacias84 — Thu, 16 May 2013 16:18:16 GMT

what does your search currently look like?

bmacias84 — Thu, 16 May 2013 16:36:15 GMT

@aferone,

Try this. keep in mind you are searching all event and indexs with this query.



index=* | dedup host, index | table index, host

Hope this helps or gets you started. Dont forget to accept and vote answers that help.

Cheers.

chris — Thu, 16 May 2013 17:00:21 GMT

You could try this over all time, but it can take a long time:

| metasearch | stats dc(host) by index

aferone — Thu, 16 May 2013 17:36:01 GMT

I was hoping for something quicker, like in metadata. Searching every record just isn't feasible. But thanks!

aferone — Thu, 16 May 2013 17:36:08 GMT

I was hoping for something quicker, like in metadata. Searching every record just isn't feasible. But thanks!

aferone — Thu, 16 May 2013 17:39:05 GMT

| metadata type=hosts index= | stats count by host

I can get a list of hostnames using this query. Is there a way to get the table I am looking for with this metadata?

chris — Tue, 21 May 2013 06:32:24 GMT

I don't think so ... but maybe someone will come up with a creative solution

varad_joshi — Fri, 19 Aug 2016 12:09:52 GMT

index=* | stats values(host) by index

This would also work but then it actually searches all the indexes for all the time. Well if that's what you want then this will work.

jpgordon — Thu, 31 May 2018 17:00:10 GMT

Old thread, but I figured out a way to do this with metadata.

And you just keep appending until you get all the indexes you wanted.
Kind of wonky, but it's fast.

FrankVl — Thu, 31 May 2018 18:00:05 GMT

Was tstats invented after 2013, or did everyone just forget about that?

Just do a:

| tstats dc(host) where index=* by index