Is there a Splunk search command that raises an alert when a host's count is high compared to other hosts?


Dear All,

I need help raising an alert that would return which host has a higher count than the others. Below is the output of my search query. Please suggest the comparison or suitable command to this issue.

host count
ABC 1349
DEF 1598
GHI 1123
KLM 1150
NOP 1329

0 Karma

Ultra Champion

hello there, hope i understand your requirement
try this:

| tstats count as event_count where index=* by host
| sort 1 -event_count

change the number after sort to show how many hosts with the most events will appear in your results

0 Karma


What about | top 1 instead of sort?

Sort has a 10k limit by default.

0 Karma

Splunk Employee
Splunk Employee

Hi @kundanbisht,

Thank you for posting your search outputs above. But would you mind posting the search that you tried, even though it didn't work? Generally, our community is more inclined to help out if they have more to go on.

Happy Splunking!

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...