topic Re: count on 2 fields in Splunk Search

count on 2 fields

sgsplunk78 — Mon, 21 Oct 2013 13:15:45 GMT

Hello,

The command Who returns me the log :
USERNAME LINE HOSTNAME TIME root pts/1 PC1.domain.com Oct 21 14:17 root pts/2 PC2.domain.com Oct 21 14:17 USER3 pts/4 PC3.domain.com Oct 17 17:19

host = HOSTA source = who sourcetype = who

I would like to know who is connecting to my servers and from which terminal. I use the command : index=Logs source="who" (host=HOSTA) | multikv forceheader=1 | chart count by HOSTNAME, host.
Result =

HOSTNAME ↧ HOSTA↕

PC1.domain.com 48

PC2.domain.com 4

PC3.domain.com 2

But there is not the column USERNAME. I would like, a colum : Hostname,a column : Username, and the column : Host containing the count as it's done at the moment. It will be very cool if I could have the last day the couple USERNAME/Hostname has been seen.

Thanks for your help,

Regards,

Re: count on 2 fields

lukejadamec — Mon, 21 Oct 2013 13:36:44 GMT

Have you tried:

index=Logs source="who" (host=HOSTA) | multikv forceheader=1  | chart count by USERNAME,HOSTNAME,host

Re: count on 2 fields

sgsplunk78 — Mon, 21 Oct 2013 13:41:32 GMT

Yes,
but it returns me :
Error in 'chart' command: The argument 'host' is invalid.

It seems that if I put more than 2 fields after "chart count by", an error occurs....

Thanks,

Re: count on 2 fields

aholzer — Mon, 21 Oct 2013 14:18:54 GMT

do stats instead of chart

Re: count on 2 fields

sgsplunk78 — Mon, 21 Oct 2013 14:32:26 GMT

YES!!!!
Thanks a lot