- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

rudy_dom
Engager
10-03-2013
07:34 AM
Soo - I got this great search to show how many hosts at each location we are getting logs from. I want to only display the ones that have less than 3 reporting in.
This is what I have so far:
host=host2 OR host=*host1 OR host=otherhost | rex field=host "(?
I thought I could add this:
| eval (distinct_count(host)) < 3
But it does not work.
I guess I need to assign a key to the value derived from "stats distinct_count(host) by fruit" so I can use that key for the evaluation. where does not work either.
Rudy
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sdaniels

Splunk Employee
10-03-2013
07:46 AM
So you tried this:
host=host2 OR host=host1 OR host=otherhost* | rex field=host "(?<fruit>d{4})" | fields fruit host | stats distinct_count(host) as myCount by fruit | sort -myCount
and then you could add
where myCount < 3 or | search myCount < 3
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sdaniels

Splunk Employee
10-03-2013
07:46 AM
So you tried this:
host=host2 OR host=host1 OR host=otherhost* | rex field=host "(?<fruit>d{4})" | fields fruit host | stats distinct_count(host) as myCount by fruit | sort -myCount
and then you could add
where myCount < 3 or | search myCount < 3
