Splunk Search

How do you count the total # of hostnames and the total # when that value is blank.?

DEAD_BEEF
Builder

I have network logs and sometimes the DNS name is there, and sometimes it isn't. I am struggling to create a simple table that shows me the total # of hostnames when there is a value and the total # when it is blank.

sample data

host       hostname
1.1.1.1    host-1.com
2.2.2.2
3.3.3.3    host-3.com
4.4.4.4    host-4.com
5.5.5.5

desired output

Named    Blank
3        2

current query

| tstats count where index=network by host prestats=t
| lookup dnslookup clientip as host OUTPUT clienthost as hostname
| eventstats count(eval(NOT hostname="*")) AS Blank count(eval(hostname="*")) AS Named by hostname

final working query

| tstats count where index=network by host 
| lookup dnslookup clientip as host OUTPUT clienthost as hostname
| stats count(eval(isnull(fqdn))) AS Blank count(eval(isnotnull(fqdn))) AS Named 
0 Karma
1 Solution

whrg
Motivator

Try it like this:

... | stats count(eval(isnull(hostname))) AS Blank count(eval(isnotnull(hostname))) AS Named

View solution in original post

0 Karma

whrg
Motivator

Try it like this:

... | stats count(eval(isnull(hostname))) AS Blank count(eval(isnotnull(hostname))) AS Named
0 Karma

DEAD_BEEF
Builder

That worked perfectly, thanks @whrg! I was going in circles with eventstats.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...