How to add an additional column to my report (I need a hostname column).

[agoktas]

Here is my search:

index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "\nName=(?PIBM.{1,})" | chart count by SvcName | rename SvcName as "Service Name"

And I need to add another column to the right of the "Service Name" column called "Host". This way I have the windows service name associated with the host that I'm looking for.

How do I adjust my search string to add this column to the statistics table view?

Thanks!

[sideview · Accepted solution]

I think you just need.

index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "nName=(?PIBM.{1,})" | stats count by SvcName host | rename SvcName as "Service Name"

[agoktas]

Thank you so much! That works perfectly! Apparently I'm a total noob when it comes to tabl'ing out my results. 😉

[sideview]

no worries. Here's a link to give you some insight into the difference between the stats and chart commands - http://answers.splunk.com/answers/32001/difference-stats-and-chart.html