How do i get a count of all my assets by Splunk Version by Os

[veryfoot]

Hi Splunkers,

I'm new in the Splunk world.

I'm trying for a reporting tasks, to obtain the counting of every Client or server (all asset with splunk deamon) by version of splunk release by Os type.

Im not familiat with "stats" command.

I tryed somthings like this :

index="_internal" sourcetype="splunkd" group=tcpin_connections (os=windows OR os=linux) (version=7* OR version=8*) 
| table version, os, hostname
| dedup hostname
| stats count as hostname by version,os

But the results seems to be incorrect. I cant figure it out what i am doing wrong in order to obtain something like this :

Splunk version  | os      | Hostname_count_result
8.x.x           | linux   | sum of hostnames
8.x.x           | windows | sum of hostnames
7.x.x           | linux   | sum of hostnames
7.x.x           | windows | sum of hostnames

Many thanks for your returns !

Regards

[richgalloway · Accepted solution]

You have the right idea.  This works for me and is little more performant.  I added version=9* because I don't have any version 7 or 8 instances.

index="_internal" sourcetype="splunkd" group=tcpin_connections (os=windows OR os=linux) (version=7* OR version=8* OR version=9*)
| fields version, os, hostname
| stats dc(hostname) as hostname by version,os

What made you think the original results were incorrect?

[veryfoot]

Hi and many thank for your fast return.

About my doubts of my results, I think i wasnt sure that the counting were correct, beacause I have more than 20 000 assets... The usage of the "stats" command is for now, a bit foggy to me. So i wasnt sure of my search request.

While trying differents things, the differents results was not concordants... so I wanted to check that my method was correct.

Many thanks again for the solution, it do perfectly the result I needed !

Best regards my new Splunk friend ^^