Trying to create a csv file with information that includes the total count of systems, OS, and current time
| inputlookup managed_hosts
| get_os_cat(host_name, category)
| search category=server
| rename category AS os
| eval rel_time = now() - not sure if this is correct, but this will take the current time??
here is where I get a bit confused, I know that I need to keep OS, and current time, but when I run the command below I get rid of OS and the time
| stats count by host_name
| stats sum(count) as total
| table total os rel_time
not sure how to go about adding OS and time to the total count of servers eventually tabling the results
I want one column to show OS, one to show the time, and the last as count
I want to use this csv to build a trend graph over time that I will run the report on a weekly basis
Thank you for the help
