Hi Splunkers,
I'm new in the Splunk world.
I'm trying for a reporting tasks, to obtain the counting of every Client or server (all asset with splunk deamon) by version of splunk release by Os type.
Im not familiat with "stats" command.
I tryed somthings like this :
index="_internal" sourcetype="splunkd" group=tcpin_connections (os=windows OR os=linux) (version=7* OR version=8*)
| table version, os, hostname
| dedup hostname
| stats count as hostname by version,os
But the results seems to be incorrect. I cant figure it out what i am doing wrong in order to obtain something like this :
Splunk version | os | Hostname_count_result
8.x.x | linux | sum of hostnames
8.x.x | windows | sum of hostnames
7.x.x | linux | sum of hostnames
7.x.x | windows | sum of hostnames
Many thanks for your returns !
Regards
You have the right idea. This works for me and is little more performant. I added version=9* because I don't have any version 7 or 8 instances.
index="_internal" sourcetype="splunkd" group=tcpin_connections (os=windows OR os=linux) (version=7* OR version=8* OR version=9*)
| fields version, os, hostname
| stats dc(hostname) as hostname by version,os
What made you think the original results were incorrect?
You have the right idea. This works for me and is little more performant. I added version=9* because I don't have any version 7 or 8 instances.
index="_internal" sourcetype="splunkd" group=tcpin_connections (os=windows OR os=linux) (version=7* OR version=8* OR version=9*)
| fields version, os, hostname
| stats dc(hostname) as hostname by version,os
What made you think the original results were incorrect?
Hi and many thank for your fast return.
About my doubts of my results, I think i wasnt sure that the counting were correct, beacause I have more than 20 000 assets... The usage of the "stats" command is for now, a bit foggy to me. So i wasnt sure of my search request.
While trying differents things, the differents results was not concordants... so I wanted to check that my method was correct.
Many thanks again for the solution, it do perfectly the result I needed !
Best regards my new Splunk friend ^^