Splunk Search

How to limit results to one (1) for each host?

Bleepie
Communicator

Hi,

How do I limit the results per host? I have any (random) search query. I have 10 hosts. For each hosts, hundreds of events are shown. In a statistics table, I want to show only 1 event, per host. This way, I can check if each host has the logfile. It doesn't matter what the contents of the logfile are.

How do I perform this search?

This statistics table, or splunk dashboard, will have the following function:

Check if log exists on every server

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Bleepie,

did you tried with dedup (https://docs.splunk.com/Documentation/SCS/current/SearchReference/DedupCommandOverview)?

<your_search>
| dedup host
| sort host
| table host

but in this way you have only the list of hosts with events.

If you want o check if there are some missing host, you have to create a lookup (called e.g. perimeter.csv) containing at least one column called host and then run a search like the following:

| tstats count WHERE index=your_index BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

in this way, if you have results the host is missed.

Ciao.

Giuseppe

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...