Dear All,
I need help raising an alert that would return which host has a higher count than the others. Below is the output of my search query. Please suggest the comparison or suitable command to this issue.
host count
ABC 1349
DEF 1598
GHI 1123
KLM 1150
NOP 1329
hello there, hope i understand your requirement
try this:
| tstats count as event_count where index=* by host
| sort 1 -event_count
change the number after sort
to show how many hosts with the most events will appear in your results
What about | top 1 instead of sort?
Sort has a 10k limit by default.
Hi @kundanbisht,
Thank you for posting your search outputs above. But would you mind posting the search that you tried, even though it didn't work? Generally, our community is more inclined to help out if they have more to go on.
Happy Splunking!