I have network logs and sometimes the DNS name is there, and sometimes it isn't. I am struggling to create a simple table that shows me the total # of hostnames when there is a value and the total # when it is blank.
sample data
host hostname
1.1.1.1 host-1.com
2.2.2.2
3.3.3.3 host-3.com
4.4.4.4 host-4.com
5.5.5.5
desired output
Named Blank
3 2
current query
| tstats count where index=network by host prestats=t
| lookup dnslookup clientip as host OUTPUT clienthost as hostname
| eventstats count(eval(NOT hostname="*")) AS Blank count(eval(hostname="*")) AS Named by hostname
final working query
| tstats count where index=network by host
| lookup dnslookup clientip as host OUTPUT clienthost as hostname
| stats count(eval(isnull(fqdn))) AS Blank count(eval(isnotnull(fqdn))) AS Named
Try it like this:
... | stats count(eval(isnull(hostname))) AS Blank count(eval(isnotnull(hostname))) AS Named
Try it like this:
... | stats count(eval(isnull(hostname))) AS Blank count(eval(isnotnull(hostname))) AS Named
That worked perfectly, thanks @whrg! I was going in circles with eventstats
.