Splunk Search

How to count hosts that have a field value of ((X OR Y) AND (A OR B)), over the course of time?

stakor
Path Finder

I am looking to find hosts that have two field values over the course of time for the search, for example a week.

That value has to be either X or Y, to count as a 'hit'. And at some other point in the time window, it also has to be A or B.

I am trying to display hosts that have at least two unique values for that field, that fall into BOTH of those clusters of values.

Example:
Host1 A
Host2 A
Host1 X
Host2 B

Host1 would be displayed, as it has a value for ((A OR B) AND (X OR Y))

Not sure how to pull that off yet.

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

You can use search to do the filtering. The question is how do you want the final result displayed.

For example, if all you care about is just the individual values for the "host" field, then this should work (assume your special field is denoted as "MyField").

<YOUR_BASE_SEARCH> 
| stats values(MyField) as MyField by host 
| search (MyField=X OR MyField=Y) (MyField=A OR MyField=B) 
| fields host

View solution in original post

rjthibod
Champion

You can use search to do the filtering. The question is how do you want the final result displayed.

For example, if all you care about is just the individual values for the "host" field, then this should work (assume your special field is denoted as "MyField").

<YOUR_BASE_SEARCH> 
| stats values(MyField) as MyField by host 
| search (MyField=X OR MyField=Y) (MyField=A OR MyField=B) 
| fields host

stakor
Path Finder

Perfect. I was trying to get tricky and go down the wrong road, doing evals, etc. Just keep it simple.

Thank you.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...