Solved: Count per host - Splunk Community

Splunk Search

I'm trying to rename the IP's of our servers to splunknodes

host_ip host_name

ip-111-11-1-11	Searchhead
ip-111-11-1-12	Searchhead
ip-111-11-1-10	Masternode
ip-111-11-2-11	Indexer
ip-111-11-2-12	Indexer
ip-111-11-2-10	Deploymentserver

How do I get it to count the duplicates?:

host_ip host_name

ip-111-11-1-11	Searchhead1
ip-111-11-1-12	Searchhead2
ip-111-11-1-10	Masternode
ip-111-11-2-11	Indexer1
ip-111-11-2-12	Indexer2
ip-111-11-2-10	Deploymentserver

Thanks in advance!

1 Solution

Solution

Hi!! try this:

your search
| streamstats count by host_name
| eval host_name=host_name.count
| fields - count

View solution in original post

Solution

Hi!! try this:

your search
| streamstats count by host_name
| eval host_name=host_name.count
| fields - count

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...