Splunk stats command to get total count of existing field values in an additional new column

[mbasharat]

I have an index that has vulnerabilities that are affecting hosts.

index=vulnerabilities

Fields in the index are:

host, VulnID, VulnName

I have a lookup name Assets. It has field name DNS. This field DNS is to be used as host in index's query. e.g.

index=vulnerabilities
| stats .........
| lookup Assets DNS AS host .....

I need a query that gives me attached image results with fast performance because I have a lot of affected hosts with a lot of vulnerabilities. I will be using this query to create a scheduled report so I can reference this report in my dashboard to create panels. My query will be looking at a few days back based on my scans:

[chrisyounger · Accepted solution]

What about this: your current query | stats list(VulnID) as VulnID list(VulnName) as VulnName count(VulnID) by host

[mbasharat]

Hi @chrisyoungerjds,

With minor change, it all worked out. Instead of list, I used values and got desired output!! THANKS!