topic Re: Table with host, sourcetype, sample event or log in Splunk Search

Help with search that creates Table with host, sourcetype, sample event or log

muradgh — Wed, 01 Jun 2022 15:29:46 GMT

Hi Splunkers,

I need to make a statistical table to show me the hosts and each sourcetype that it generates and the count for each sourcetype with a column that calculates the total count and most importantly a column with a sample event from each sourcetype.

I want it to be something like the attached table:

Can someone please help me with the search that provides me with such a table?

I have tried to make such a table using the following command (without the raw log):

| tstats values(sourcetype) count where index=* by host | sort - count

but the above search counts only the total of all the sourcetypes

Then I have tried a different search:

index=* | chart count OVER host BY sourcetype useother=false limit=0

but again this is not an accurate search for what I want.

Much Thanks

Murad Ghazzawi

Re: Table with host, sourcetype, sample event or log

gcusello — Wed, 01 Jun 2022 10:35:04 GMT

Hi @muradgh,

you could try something like this:

Ciao.

Giuseppe

Re: Table with host, sourcetype, sample event or log

muradgh — Wed, 01 Jun 2022 10:46:15 GMT

Hi @gcusello

Unfortunately, this search did not provide me with what I wanted, check the below screenshot for the result of your search:

Re: Table with host, sourcetype, sample event or log

gcusello — Wed, 01 Jun 2022 10:56:52 GMT

Hi @muradgh ,

please try this:

Ciao.

Giuseppe

Re: Table with host, sourcetype, sample event or log

SinghK — Wed, 01 Jun 2022 11:15:30 GMT

Just with a small correction

index=* |stats count first(_raw) ….. rest is same. I think autocorrect messed it up.

Re: Table with host, sourcetype, sample event or log

muradgh — Wed, 01 Jun 2022 11:25:26 GMT

Hi @gcusello

Thank you for your help. 👍👍

Re: Table with host, sourcetype, sample event or log

muradgh — Wed, 01 Jun 2022 11:25:59 GMT

Hi @SinghK

Thanks for the note.