topic Re: stats count returning servers more than once using dedup in Splunk Search

stats count returning servers more than once using dedup

Thomas2 — Thu, 05 Dec 2024 16:20:25 GMT

Trying to get a count of servers sending logs to an index "cloud_servers", Running this command to get the count:
index=cloud_servers | search host="*server_name-h-nk01-*" | dedup host | stats count
The problem is, some servers it's counting twice because the server names appear with and without a fqdn depending on the type of log being sent. So dedup doesn't work since technically it is a unique host.
Example of the same server appearing with two host names:
host buffnybd1-h-nk01-555
host buffnybd1-h-nk01-555.nyny.os1.com
Is there a way to count the server just using the first 20 or so digits, so it will ingore the fqdn?
Thank you

Re: stats count returning servers more than once using dedup

gcusello — Thu, 05 Dec 2024 16:26:48 GMT

Hi @Thomas2 ,

at first don't use the search command after the mai nsearch.

then anyway, you can use the rex command to extract the first part of the field or eval to use the first 20 chars.

index=cloud_servers host="*server_name-h-nk01-*" | rex field=host "^(?<host>[^\.]+)" | stats dc(host) AS count

Ciao.

Giuseppe

Re: stats count returning servers more than once using dedup

Thomas2 — Thu, 05 Dec 2024 19:53:17 GMT

Let me give this a try. Thank you, Giuseppe

Re: stats count returning servers more than once using dedup

bowesmana — Thu, 05 Dec 2024 23:57:46 GMT

Also unless you absolutely have to, avoid using leading wildcards in the search term host="*..."

Re: stats count returning servers more than once using dedup

gcusello — Fri, 06 Dec 2024 06:56:13 GMT

Hi @Thomas2 ,

conferming what @bowesmana pointed out,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

Re: stats count returning servers more than once using dedup

Thomas2 — Fri, 06 Dec 2024 18:22:44 GMT

Yes this worked, thank you very much

Re: stats count returning servers more than once using dedup

Thomas2 — Fri, 06 Dec 2024 18:23:19 GMT

Yes I took out the leading *. Thank you much