topic Re: Count # of sensors by host and dashboard in Splunk Search

Count # of sensors by host and dashboard

ksheikh786 — Wed, 22 Jan 2025 04:10:22 GMT

Calculating metrics. I need to count the number of sensors that are created and monitored for each host. I have the index and sourcetype.

I created about 7 different dashboards with multiple host on each dashboard and I need to get a count on the number of sensors that are being monitored by each host.

index=idx_sensors sourcetype = sensorlog | stats count by host

the above query is giving me all the hostnames that are being monitored but the count is giving me all the events... I just need the # of sensors per host.

Re: Count # of sensors by host and dashboard

isoutamo — Wed, 22 Jan 2025 05:41:06 GMT

Can you give sample of your events?
You could add another or more field after by on stats if there is something which you could use.

Re: Count # of sensors by host and dashboard

bowesmana — Wed, 22 Jan 2025 05:41:58 GMT

Use dc

index=idx_sensors sourcetype = sensorlog | stats dc(sensor_field) as sensors by host

Re: Count # of sensors by host and dashboard

ksheikh786 — Wed, 22 Jan 2025 05:57:41 GMT

Lets say I have a dashboard setup with 5 hosts (serverA, serverB, serverC, serverD, serverE), for each host there are 5-10 queries setup to pull data using the same index=idx_sensors.

I can manually count and see that there are x # of sensors setup per hostname.

How would I create a query to check how many sensors are being monitored by hostname?

(I've got 7 diff dashboards w/ multiple hosts monitoring X number of sensors. I need to get metrics for which host has how many sensors that are currently being monitored.)

Re: Count # of sensors by host and dashboard

bowesmana — Wed, 22 Jan 2025 06:02:19 GMT

Did you try the query I posted?

Re: Count # of sensors by host and dashboard

ksheikh786 — Wed, 22 Jan 2025 06:03:39 GMT

Yes, it returned 0s

Re: Count # of sensors by host and dashboard

yuanliu — Wed, 22 Jan 2025 06:08:28 GMT

I can manually count and see that there are x # of sensors setup per hostname.

You need to show volunteers here HOW do you count number of sensors from logs (without using SPL).

Here are four commandments to help you ask answerable questions in this forum:

Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search (SPL that volunteers here do not have to look at).
Illustrate the desired output from illustrated data.
Explain the logic between illustrated data and desired output without SPL.
If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.

Re: Count # of sensors by host and dashboard

bowesmana — Wed, 22 Jan 2025 06:08:42 GMT

What field does your data contain that holds the sensor value? Did you change the query as needed to pick up that field.

Re: Count # of sensors by host and dashboard

ksheikh786 — Wed, 22 Jan 2025 08:07:38 GMT

I need to track the number of alerts configured under index=idx_sensors by hostname

Re: Count # of sensors by host and dashboard

yuanliu — Fri, 24 Jan 2025 23:45:26 GMT

You haven't answered key questions from me and @bowesmana. Without SPL, what do you use to count number of sensors per host (if the total number of events is not the answer).

Let me repeat the four commandments of asking answerable questions in this forum:

Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search (SPL that volunteers here do not have to look at).
Illustrate the desired output from illustrated data.
Explain the logic between illustrated data and desired output without SPL.
If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.