https://community.splunk.com/t5/Splunk-Search/Vulnerabilities-per-computer/m-p/81755#M181874 <P>You don't specify the results you are getting, but based on the search you're issuing it looks like the problem lies within the <CODE>dedup host</CODE> directive. This will make Splunk include only one event per unique value for the <CODE>host</CODE> field. Remove that part of your search and you should be good to go, i.e.:</P> <PRE><CODE>sourcetype=my_logs category=4 OR category=5 business=*My_business* | stats count by host as Vuln | sort -count </CODE></PRE> <P>You can also use <CODE>top</CODE> instead of <CODE>stats count</CODE> which has the advantage that it also gives you how many percent each host contributes to the total number of vulnerabilities.</P> Thu, 14 Apr 2011 20:54:11 GMT Ayn 2011-04-14T20:54:11Z https://community.splunk.com/t5/Splunk-Search/Vulnerabilities-per-computer/m-p/81754#M181873 <P>hi, I am new to splunk and am trying to make a querry to give me all vulnerabilities of each computer in my domain. I have the following but it does not seem to work.</P> <PRE><CODE>sourcetype=my_logs category=4 OR category=5 business=*My_business* |dedup host | stats count(signature) by host as Vuln |sort -count </CODE></PRE> <P>thank you</P> Thu, 14 Apr 2011 20:31:24 GMT https://community.splunk.com/t5/Splunk-Search/Vulnerabilities-per-computer/m-p/81754#M181873 TomCollick 2011-04-14T20:31:24Z https://community.splunk.com/t5/Splunk-Search/Vulnerabilities-per-computer/m-p/81755#M181874 <P>You don't specify the results you are getting, but based on the search you're issuing it looks like the problem lies within the <CODE>dedup host</CODE> directive. This will make Splunk include only one event per unique value for the <CODE>host</CODE> field. Remove that part of your search and you should be good to go, i.e.:</P> <PRE><CODE>sourcetype=my_logs category=4 OR category=5 business=*My_business* | stats count by host as Vuln | sort -count </CODE></PRE> <P>You can also use <CODE>top</CODE> instead of <CODE>stats count</CODE> which has the advantage that it also gives you how many percent each host contributes to the total number of vulnerabilities.</P> Thu, 14 Apr 2011 20:54:11 GMT https://community.splunk.com/t5/Splunk-Search/Vulnerabilities-per-computer/m-p/81755#M181874 Ayn 2011-04-14T20:54:11Z