topic Re: How to concatenate events from multiple hosts as single host in Splunk Search

How to concatenate events from multiple hosts as single host?

sekhar463 — Fri, 05 Aug 2022 14:38:16 GMT

Hai All,

we have events from different hosts with same name. any search query to add them in single host field

please suggest

dallvcrfix1p	1913
dallvcrfix1p.ops.invesco.net	20

Re: How to concatenate events from multiple hosts as single host

Siddharth — Fri, 05 Aug 2022 13:49:18 GMT

if you just want total use this after your query

addtotals row=f col=t labelfield=host sum(field_you_want_count)

Re: How to concatenate events from multiple hosts as single host

sekhar463 — Fri, 05 Aug 2022 13:51:59 GMT

index=indexname addtotals row=f col=t labelfield=host sum(host)

no results i am trying this

Re: How to concatenate events from multiple hosts as single host

Siddharth — Fri, 05 Aug 2022 13:55:41 GMT

Can you send me the query how did you get this result

dallvcrfix1p	1913
dallvcrfix1p.ops.invesco.net	20

Re: How to concatenate events from multiple hosts as single host

sekhar463 — Fri, 05 Aug 2022 15:09:53 GMT

i m using query index=ivz_unix_linux_events |stats count by host

and in events we have hostnames with 2 hostnames so i want add count both for single filed

allhebsms1p	6434
dallhebsms1p.ops.invesco.net	41
dallvcrfix1p	1688
dallvcrfix1p.ops.invesco.net	82
dallvcrfix2p	2027
dallvcrfix2p.ops.invesco.net	20
fanlvairw1d	2773
fanlvairw1d.ops.invesco.net

Re: How to concatenate events from multiple hosts as single host

martinpu — Fri, 05 Aug 2022 16:43:51 GMT

|rex field=host "(?<host>[^\.]+)"
 |stats count by host

Should do the trick.

Re: How to concatenate events from multiple hosts as single host

sekhar463 — Mon, 08 Aug 2022 09:21:29 GMT

Thanks for this

what this regex will do

index=index name |rex field=host "(?<host>[^\.]+)"
|stats count by host |dedup host

i am using this search

as based below hostnames showing for single host due to dns resolution getting like this in splunk and how we can solve this problem as single hostname

what was the workaround for to concatenate for both as single host name

dallvcrfix2p	2027
dallvcrfix2p.ops.invesco.net	20

Re: How to concatenate events from multiple hosts as single host

sekhar463 — Mon, 08 Aug 2022 10:47:12 GMT

while trying with above query still i am getting hostname are not getting one