Splunk Search

How to create splunk search for common filed/value across the multiple servers?

agarwal_sumit
New Member

Hello All,

I am trying to build search for common value across multiple host. For example , i have a common field call "eventID" across the multiple host. eventID is dynamic value and keep on changing. How do i build my query so that i can search for host with same eventID.

Also there are other fields, which i want to capture along with host. so final table should be-
eventID host CONNID Time

Tags (1)
0 Karma

woodcock
Esteemed Legend

Try this:

Your Base Search Here | stats first(_time) AS Time values(host) AS host values(CONNID) AS CONNID range(_time) AS duration BY eventID
0 Karma

cmerriman
Super Champion

you can try to do something like ...|stats values(host) by eventID to get a list of all hosts that have each eventID

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...