Splunk Search

How to create a query wit top notable event sources with HOSTNAME?

tokio13
Path Finder

Hello

Could someone help me with a query?

I have this default report Top Notable Event Sources which returns me IP's (count, sparkline etc). How can I add an extra column to have the hostname of those IP's? 

 

Tags (1)
0 Karma

tokio13
Path Finder

Yes,  for that one

0 Karma

Azeemering
Builder

Then your answer is in my first reply 🙂

0 Karma

tokio13
Path Finder

It actually worked only if I mention the Indexer, but that looks to consume quite a lot of resources 

Tags (1)
0 Karma

Azeemering
Builder

Hi,

You could just add the field host to the search. It will then show under Statistics.
This is for the Search "Notable - Top Notable Event Sources" in Enterprise Security if that is what you mean?

| `es_notable_events` | search timeDiff_type=current src!=unknown | stats sparkline(sum(count),30m) as sparkline,dc(rule_name) as correlation_search_count,dc(security_domain) as security_domain_count,sum(count) as count by src, host
| sort 100 - count,correlation_search_count

 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...