topic Re: Sourcetype count per host in Splunk Search

Sourcetype count per host

warmup031 — Mon, 08 Jun 2020 22:03:05 GMT

Hello,

I would like to Check for each host, its sourcetype and count by Sourcetype.
I tried host=* | stats count by host, sourcetype

But in fact I need all the sourcetypes to be set as column, and get the count by host for each sourcetype. Can you help ?

Many thanks

Re: Sourcetype count per host

adonio — Wed, 01 Apr 2020 12:21:46 GMT

try this:

| tstats count as event_count where index=* by host sourcetype

Re: Sourcetype count per host

gcusello — Wed, 01 Apr 2020 12:24:31 GMT

Hi @warmup031,
did you tried?

index=your_index 
| stats count by sourcetype host

host=* isn't needed because all the events has the field host and use always the index in main search.

Ciao.
Giuseppe

Re: Sourcetype count per host

warmup031 — Wed, 01 Apr 2020 12:39:14 GMT

Hello gcusello and adonio, I already tried thèse search but my main problem is to set each sourcetype as a column, hosts as row and get sourcetype count valid for each host
Thank you

Re: Sourcetype count per host

gcusello — Wed, 01 Apr 2020 13:36:41 GMT

Hi @warmup031,
please, try this

index=wineventlog
| chart count OVER host BY sourcetype

Ciao.
Giuseppe

Re: Sourcetype count per host

warmup031 — Wed, 01 Apr 2020 13:45:36 GMT

Wonderful, thank you very much Giuseppe

Re: Sourcetype count per host

gcusello — Wed, 01 Apr 2020 13:46:41 GMT

You're welcome!
Ciao and Next time.
Giuseppe