The solution to this is similar to finding out the most common values for any field across all hosts.
There are many pieces to getting this to work. First, you must expand the data using multikv:
sourcetype=rpm | multikv noheader=t
Add in the field extraction:
sourcetype=rpm | multikv noheader=t | rex "(?<package>\S+)"
Next, you need to find all of the hosts that exist for each package:
sourcetype=rpm | multikv noheader=t | rex "(?<package>\S+)" | stats dc(host) as dc by package
Find the maximum number of hosts that exist per package:
sourcetype=rpm | multikv noheader=t | rex "(?<package>\S+)" | stats dc(host) as dc by package | eventstats max(dc) as max
Search for the packages that meet the maximum number:
sourcetype=rpm | multikv noheader=t | rex "(?<package>\S+)" | stats dc(host) as dc by package | eventstats max(dc) as max | where dc = max
Finally, clean up your output to be a simple list:
sourcetype=rpm | multikv noheader=t | rex "(?<package>\S+)" | stats dc(host) as dc by package | eventstats max(dc) as max | where dc = max | table package
Here is another way to do this:
sourcetype=rpm | multikv noheader=t | rex "(?<package>\S+)" | stats count by package host | eventstats dc(host) as dc by package | eventstats max(dc) as max | where dc == max | xyseries package host count
Credit to Dr. Zhang for showing us how to do this.
