https://community.splunk.com/t5/Splunk-Search/How-to-limit-results-to-one-1-for-each-host/m-p/660519#M228041 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237299">@Bleepie</a>,</P><P>did you tried with dedup (<A href="https://docs.splunk.com/Documentation/SCS/current/SearchReference/DedupCommandOverview" target="_blank">https://docs.splunk.com/Documentation/SCS/current/SearchReference/DedupCommandOverview</A>)?</P><LI-CODE lang="markup">&lt;your_search&gt; | dedup host | sort host | table host</LI-CODE><P>but in this way you have only the list of hosts with events.</P><P>If you want o check if there are some missing host, you have to create a lookup (called e.g. perimeter.csv) containing at least one column called host and then run a search like the following:</P><LI-CODE lang="markup">| tstats count WHERE index=your_index BY host | append [ | inputlookup perimeter.csv | eval count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>in this way, if you have results the host is missed.</P><P>Ciao.</P><P>Giuseppe</P><P>Ciao.</P><P>Giuseppe</P> Thu, 12 Oct 2023 12:11:45 GMT gcusello 2023-10-12T12:11:45Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-results-to-one-1-for-each-host/m-p/660500#M228027 <P>Hi,</P><P>How do I limit the results per host? I have any (random) search query. I have 10 hosts. For each hosts, hundreds of events are shown. In a statistics table, I want to show only 1 event, per host. This way, I can check if each host has the logfile. It doesn't matter what the contents of the logfile are.</P><P>How do I perform this search?<BR /><BR />This statistics table, or splunk dashboard, will have the following function:<BR /><BR />Check if log exists on every server</P> Thu, 12 Oct 2023 10:26:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-results-to-one-1-for-each-host/m-p/660500#M228027 Bleepie 2023-10-12T10:26:26Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-results-to-one-1-for-each-host/m-p/660519#M228041 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237299">@Bleepie</a>,</P><P>did you tried with dedup (<A href="https://docs.splunk.com/Documentation/SCS/current/SearchReference/DedupCommandOverview" target="_blank">https://docs.splunk.com/Documentation/SCS/current/SearchReference/DedupCommandOverview</A>)?</P><LI-CODE lang="markup">&lt;your_search&gt; | dedup host | sort host | table host</LI-CODE><P>but in this way you have only the list of hosts with events.</P><P>If you want o check if there are some missing host, you have to create a lookup (called e.g. perimeter.csv) containing at least one column called host and then run a search like the following:</P><LI-CODE lang="markup">| tstats count WHERE index=your_index BY host | append [ | inputlookup perimeter.csv | eval count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>in this way, if you have results the host is missed.</P><P>Ciao.</P><P>Giuseppe</P><P>Ciao.</P><P>Giuseppe</P> Thu, 12 Oct 2023 12:11:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-results-to-one-1-for-each-host/m-p/660519#M228041 gcusello 2023-10-12T12:11:45Z