https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-stats-by-host/m-p/135691#M37116 <P>Try this:</P> <PRE><CODE>index=sc-perfmon sourcetype="Perfmon*" counter="Free Megabytes" OR "User Time" OR "Available MBytes" | stats sparkline, latest(_time) as latest_event by sourcetype, host | eval "time since latest event"=((now() -latest_event)/60)| sort "time since latest event" | fieldformat latest_event = strftime(latest_event, "%F %T") </CODE></PRE> Thu, 04 Jun 2015 13:35:22 GMT woodcock 2015-06-04T13:35:22Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-stats-by-host/m-p/135690#M37115 <P>Hello,</P> <P>In the below given search, I want to show data by "host", so please could anybody suggest me how to do this? </P> <PRE><CODE>index=sc-perfmon sourcetype="Perfmon*" counter="Free Megabytes" OR "User Time" OR "Available MBytes" | stats sparkline, latest(_time) as latest_event by sourcetype | eval "time since latest event"=((now() -latest_event)/60)| sort "time since latest event" | fieldformat latest_event = strftime(latest_event, "%F %T") </CODE></PRE> <P>Thanks<BR /> Ankit</P> Thu, 04 Jun 2015 13:26:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-stats-by-host/m-p/135690#M37115 sunnyparmar 2015-06-04T13:26:32Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-stats-by-host/m-p/135691#M37116 <P>Try this:</P> <PRE><CODE>index=sc-perfmon sourcetype="Perfmon*" counter="Free Megabytes" OR "User Time" OR "Available MBytes" | stats sparkline, latest(_time) as latest_event by sourcetype, host | eval "time since latest event"=((now() -latest_event)/60)| sort "time since latest event" | fieldformat latest_event = strftime(latest_event, "%F %T") </CODE></PRE> Thu, 04 Jun 2015 13:35:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-stats-by-host/m-p/135691#M37116 woodcock 2015-06-04T13:35:22Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-stats-by-host/m-p/135692#M37117 <P>Thanks a lot buddy.. it works..</P> Thu, 04 Jun 2015 13:39:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-stats-by-host/m-p/135692#M37117 sunnyparmar 2015-06-04T13:39:36Z