https://community.splunk.com/t5/Splunk-Search/How-to-create-splunk-search-for-common-filed-value-across-the/m-p/312269#M160976 <P>Try this:</P> <PRE><CODE>Your Base Search Here | stats first(_time) AS Time values(host) AS host values(CONNID) AS CONNID range(_time) AS duration BY eventID </CODE></PRE> Fri, 26 May 2017 15:04:42 GMT woodcock 2017-05-26T15:04:42Z https://community.splunk.com/t5/Splunk-Search/How-to-create-splunk-search-for-common-filed-value-across-the/m-p/312267#M160974 <P>Hello All,</P> <P>I am trying to build search for common value across multiple host. For example , i have a common field call "eventID" across the multiple host. eventID is dynamic value and keep on changing. How do i build my query so that i can search for host with same eventID. </P> <P>Also there are other fields, which i want to capture along with host. so final table should be-<BR /> eventID host CONNID Time </P> Fri, 26 May 2017 02:48:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-splunk-search-for-common-filed-value-across-the/m-p/312267#M160974 agarwal_sumit 2017-05-26T02:48:27Z https://community.splunk.com/t5/Splunk-Search/How-to-create-splunk-search-for-common-filed-value-across-the/m-p/312268#M160975 <P>you can try to do something like <CODE>...|stats values(host) by eventID</CODE> to get a list of all hosts that have each eventID</P> Fri, 26 May 2017 12:47:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-splunk-search-for-common-filed-value-across-the/m-p/312268#M160975 cmerriman 2017-05-26T12:47:16Z https://community.splunk.com/t5/Splunk-Search/How-to-create-splunk-search-for-common-filed-value-across-the/m-p/312269#M160976 <P>Try this:</P> <PRE><CODE>Your Base Search Here | stats first(_time) AS Time values(host) AS host values(CONNID) AS CONNID range(_time) AS duration BY eventID </CODE></PRE> Fri, 26 May 2017 15:04:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-splunk-search-for-common-filed-value-across-the/m-p/312269#M160976 woodcock 2017-05-26T15:04:42Z