Is there a Splunk search command that raises an alert when a host's count is high compared to other hosts?

[bishtk]

Dear All,

I need help raising an alert that would return which host has a higher count than the others. Below is the output of my search query. Please suggest the comparison or suitable command to this issue.

host count
ABC 1349
DEF 1598
GHI 1123
KLM 1150
NOP 1329

[adonio]

hello there, hope i understand your requirement
try this:

| tstats count as event_count where index=* by host
| sort 1 -event_count

change the number after sort to show how many hosts with the most events will appear in your results

[jkat54]

What about | top 1 instead of sort?

Sort has a 10k limit by default.

[mstjohn_splunk]

Hi @kundanbisht,

Thank you for posting your search outputs above. But would you mind posting the search that you tried, even though it didn't work? Generally, our community is more inclined to help out if they have more to go on.

Happy Splunking!