Splunk Search

How do I create a search that displays Host, Total Event Count, Latest Event, and Earliest Event?

JoshuaJ
New Member

When I first log in to Splunk, one of the first things I see is called "Data Summary" (under what to search) which displays the host, total number of events indexed, earliest event, and the latest event from each host. I'm trying the recreate this table with very little success so hopefully you can help me out.

So far I have this:
* | stats count by host | sort by -count

This gives me a table with the host and total event count in descending order, but I can't figure out how to display the earliest and latest events. Any ideas? Thanks.

Tags (4)
0 Karma

lguinn2
Legend

Splunk uses the metadata command to produce the Data Summary. Try this

| metadata type=hosts
| fields host firstTime lastTime totalCount
| sort -totalCount
| fieldformat firstTime=strftime(firstTime,"%x %X")
| fieldformat lastTime=strftime(lastTime,"%x %X")

This will be much, much faster than using stats.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...