Splunk Enterprise Security

Trying to create a csv with time, count, and OS


Trying to create a csv file with information that includes the total count of systems, OS, and current time

| inputlookup managed_hosts
| get_os_cat(host_name, category)
| search category=server
| rename category AS os
| eval rel_time = now() - not sure if this is correct, but this will take the current time??

here is where I get a bit confused, I know that I need to keep OS, and current time, but when I run the command below I get rid of OS and the time

| stats count by host_name
| stats sum(count) as total
| table total os rel_time

not sure how to go about adding OS and time to the total count of servers eventually tabling the results
I want one column to show OS, one to show the time, and the last as count

I want to use this csv to build a trend graph over time that I will run the report on a weekly basis

Thank you for the help

0 Karma


the stats command dumps any information not asked for. You could try eventstats:
| eventstats sum(count) BY host_name AS Total


If this reply helps you, an upvote would be appreciated.
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.