Archive
Highlighted

list common uid on two hosts

New Member

I am trying to list out common uid on two different hosts.
I am using this but this give a visual of all uids including the common ones.
sourcetype=access $host1$ OR $host2$ error=2*| chart max(O) over host by uid

Tags (1)
0 Karma
Highlighted

Re: list common uid on two hosts

Builder

Eventstats should work, though not terribly efficient...

sourcetype=access $host1$ OR $host2$ error=2*
| eventstats dc(host) AS hosts by uid
| search hosts>1
| chart max(O) over host by uid 
0 Karma
Highlighted

Re: list common uid on two hosts

SplunkTrust
SplunkTrust

It will depend a lot on what's your final output should be. If you just want to know list of uid which are on both hosts, you could do like this

sourcetype=access $host1$ OR $host2$ error=2* | stats dc(host) as host_count by uid | where host_count=2

If you want list hosts as well,

sourcetype=access $host1$ OR $host2$ error=2*| chart dc(uid) over host by uid | addtotals | where Total=2
0 Karma