Splunk Search

How to count hosts that have a field value of ((X OR Y) AND (A OR B)), over the course of time?

Path Finder

I am looking to find hosts that have two field values over the course of time for the search, for example a week.

That value has to be either X or Y, to count as a 'hit'. And at some other point in the time window, it also has to be A or B.

I am trying to display hosts that have at least two unique values for that field, that fall into BOTH of those clusters of values.

Example:
Host1 A
Host2 A
Host1 X
Host2 B

Host1 would be displayed, as it has a value for ((A OR B) AND (X OR Y))

Not sure how to pull that off yet.

Tags (1)
0 Karma
1 Solution

Champion

You can use search to do the filtering. The question is how do you want the final result displayed.

For example, if all you care about is just the individual values for the "host" field, then this should work (assume your special field is denoted as "MyField").

<YOUR_BASE_SEARCH> 
| stats values(MyField) as MyField by host 
| search (MyField=X OR MyField=Y) (MyField=A OR MyField=B) 
| fields host

View solution in original post

Champion

You can use search to do the filtering. The question is how do you want the final result displayed.

For example, if all you care about is just the individual values for the "host" field, then this should work (assume your special field is denoted as "MyField").

<YOUR_BASE_SEARCH> 
| stats values(MyField) as MyField by host 
| search (MyField=X OR MyField=Y) (MyField=A OR MyField=B) 
| fields host

View solution in original post

Path Finder

Perfect. I was trying to get tricky and go down the wrong road, doing evals, etc. Just keep it simple.

Thank you.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!