Reporting

view report with one instance of a specific version

patrick79
Explorer

I am trying to create a report that pulls a version, but only shows one instance and then list all the hosts within that version

patrick79_0-1713363255097.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you already have the fields extracted:

<your index search>
| stats count by Name Version host
| eventstats count by Name Version
| eventstats max(count) as top
| where count=top

View solution in original post

patrick79
Explorer

I am searching for "Unified Payment Platform Version=" which contains the specific version of firmware from about 2000+ hosts. 
The line I am searching may populate multiple times depending on if the device was rebooted.

The search I need:
 - list all the versions, but only one count from each host
 - if possible, the list the hosts on the version

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some anonymised representative events in raw format in a code block </>

0 Karma

patrick79
Explorer

[2024-04-17 10:23:37] [Lane 0] Application ID: Name=Unified Payment Platform Version=06.80.06-0032

 

patrick79_0-1713371287284.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you already have the fields extracted:

<your index search>
| stats count by Name Version host
| eventstats count by Name Version
| eventstats max(count) as top
| where count=top

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

<your index search>
| eventstats count by Version
| eventstats max(count) as top
| where count=top
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...