topic Re: Create table containing hosts,sources metadata? in Splunk Search

Create table containing hosts,sources metadata?

gowen — Mon, 30 Jan 2012 23:13:23 GMT

I would like to have a list of all the hosts (over some period of time, presumably) and the sources that they've generated logs entries with. A simple table format would work, so there'd be 10 lines for host X, each with a different source listed, if host X generated logs for 10 sources.

More simply:

host1,source1
host1,source2
host2,source1
host2,source3
host2,source4

Is there a way I can get this information? I see how to pull hosts using metadata, and I see how to pull sources using metadata, but I don't see how the two can be related.

Re: Create table containing hosts,sources metadata?

sbrant_tt — Tue, 31 Jan 2012 00:50:18 GMT

You can use the following search to accomplish this (slightly different output than you've specified):

* | chart values(source) by host

Or, if you want to include the all (including internal) indexes:

index=* | chart values(source) by host

Re: Create table containing hosts,sources metadata?

lguinn2 — Tue, 31 Jan 2012 01:25:19 GMT

You will have to actually count them up:

index=* | stats count by host, source

should do it.

Re: Create table containing hosts,sources metadata?

gowen — Tue, 31 Jan 2012 13:46:13 GMT

Excellent, gives me just what I was looking for.

Re: Create table containing hosts,sources metadata?

gowen — Tue, 31 Jan 2012 13:47:01 GMT

Very good, thank you - even though the output format wasn't what I was thinking of, it's still useful and it helps me think in terms of how chart can help me. Thanks!