Splunk Search

Count per host

EH
Explorer

I'm trying to rename the IP's of our servers to splunknodes

host_ip host_name

ip-111-11-1-11Searchhead
ip-111-11-1-12Searchhead
ip-111-11-1-10Masternode
ip-111-11-2-11Indexer
ip-111-11-2-12Indexer
ip-111-11-2-10Deploymentserver


How do I get it to count the duplicates?:

host_ip host_name

ip-111-11-1-11Searchhead1
ip-111-11-1-12Searchhead2
ip-111-11-1-10Masternode
ip-111-11-2-11Indexer1
ip-111-11-2-12Indexer2
ip-111-11-2-10Deploymentserver

 

Thanks in advance!

Labels (3)
0 Karma
1 Solution

rafadvega
Path Finder

Hi!! try this:

 

your search
| streamstats count by host_name
| eval host_name=host_name.count
| fields - count

 

rafadvega_0-1636731797517.png

 

View solution in original post

rafadvega
Path Finder

Hi!! try this:

 

your search
| streamstats count by host_name
| eval host_name=host_name.count
| fields - count

 

rafadvega_0-1636731797517.png

 

Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...