Splunk Search

How to edit my search to count the number of hosts per keyword?

smhsplunk
Communicator

Each host has a particular keyword (they are extracted by field extractor), some hosts share the same keywords.
I am trying to count the number of hosts per keywords. i.e.

keyword1, - Number of times it Appears in hosts
keyword2, - Number of times it Appears in hosts

I am doing this but it is giving me a very high count

index=main host="*" 
| search * keyword!="NULL" 
| stats count(host) as host_numbers by keyword 
0 Karma
1 Solution

sundareshr
Legend

What you need is distinct_count. Try this

index=main host="" 
| search keyword!="NULL" 
| stats dc(host) as host_numbers by keyword

View solution in original post

sundareshr
Legend

What you need is distinct_count. Try this

index=main host="" 
| search keyword!="NULL" 
| stats dc(host) as host_numbers by keyword
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...