topic Re: Subsearch on results in Splunk Search

Subsearch on results

omgwut56k — Mon, 28 Sep 2020 20:00:32 GMT

Hi Answers, hopefully someone can help me figure this out.

I need to see a list of all results and a distinct count of all programs running for each host, and specifically which computers,users are running a specific program e.g logon.exe

Example data:

host=computer1 user=joe,user program=Logon.exe
host=computer1 user=joe,user program=word.exe
host=computer1 user=joe,user program=notepad.exe

host=computer2 user=jane,user program=outlook.exe
host=computer2 user=jane,user program=lotus.exe
host=computer2 user=jane,user program=notepad.exe

host=computer3 user=dave,user program=outlook.exe
host=computer3 user=dave,user program=lotus.exe
host=computer3 user=dave,user program=notepad.exe

Expected results,
computer_name user, count_of_running_programs count_of_logon.exe

Re: Subsearch on results

richgalloway — Thu, 21 May 2015 15:37:22 GMT

I think you can do this without a subsearch. Try index=foo | stats dc(program) as programCount, dc(eval(program="Logon.exe")) as logonCount by host, user | table host user programCount logonCount.

Re: Subsearch on results

omgwut56k — Thu, 21 May 2015 16:02:43 GMT

Perfect! Thank you.

Re: Subsearch on results

omgwut56k — Thu, 21 May 2015 20:35:00 GMT

Bonus points.. if you can help me identify users logged into multiple computers.. Bonus Bonus points if I can display both computes in a multi-value field as a result of the stats command.

Re: Subsearch on results

woodcock — Fri, 22 May 2015 01:29:22 GMT

Bonus points:

index=foo | stats dc(program) as programCount, dc(eval(program="Logon.exe")) as logonCount by host, user | table host user programCount logonCount | eventstats values(hosts) AS hosts by user