How to limit results to one (1) for each host?

[Bleepie]

Hi,

How do I limit the results per host? I have any (random) search query. I have 10 hosts. For each hosts, hundreds of events are shown. In a statistics table, I want to show only 1 event, per host. This way, I can check if each host has the logfile. It doesn't matter what the contents of the logfile are.

How do I perform this search?

This statistics table, or splunk dashboard, will have the following function:

Check if log exists on every server

[gcusello]

Hi @Bleepie,

did you tried with dedup (https://docs.splunk.com/Documentation/SCS/current/SearchReference/DedupCommandOverview)?

<your_search>
| dedup host
| sort host
| table host

but in this way you have only the list of hosts with events.

If you want o check if there are some missing host, you have to create a lookup (called e.g. perimeter.csv) containing at least one column called host and then run a search like the following:

| tstats count WHERE index=your_index BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

in this way, if you have results the host is missed.

Ciao.

Giuseppe

Ciao.

Giuseppe