I have 2 reports which I want to combine so that I get 1 email with both information.
1. Total number of hosts
index=abcd mysearch | stats count as Hostname
2. List of hosts
index=abcd mysearch | table Hostname
Results I expect:
Total Hostname: 145
Hostname
host1
host2
host3
Please advise.
Can you convert this to dashboard and schedule it? Probably this is the way to get exactly that expected result. Other option is get it little bit different format by next query:
index=abcde
| stats dc(Hostname) as totalHostnames values(Hostname) as Hostnames
r. Ismo
| stats dc(hostname) as count by hostname
| addcoltotals
This also works, but accepted another answer as that is better in format.
Can you convert this to dashboard and schedule it? Probably this is the way to get exactly that expected result. Other option is get it little bit different format by next query:
index=abcde
| stats dc(Hostname) as totalHostnames values(Hostname) as Hostnames
r. Ismo