How to refine search to pull the hosts that has 100+ results?

[wrongquery]

So based off my original query that shows 100+ hosts, I would like to generate a list of the hosts in statistics but my query isn't populating. It's worked before but for some reason none of the queries that are similar to this one are working. Suggestions on refining my query?

index=* sourcetype=* | stats count as host by "selected fields" | stats list(host) as host list(selected fields) as "selected fields"

[ITWhisperer]

When something stops working you should look for what has changed - for example, have you upgraded Splunk? Is data still coming into Splunk? etc.

[wrongquery]

Yes data is still coming into splunk. I've tried last four, 24, and 7 days. If I just do index=* and sourcetype=* which I understand can be a lot of data I get information, but when i do my stats it won't show but my stats was working before. Does the query look like it should work?

[ITWhisperer]

Assuming you have a field called "selected fields" or this is replaced by real field names, then the search looks like it should work.

What has changed in your environment from when it was working to when it stopped working?

[wrongquery]

Nothings changed from what I can see, the selected fields is just the top three. Host, source, and sourcetype.  Maybe just try other queries for the time being and come back to it?

[ITWhisperer]

You could try metasearch

| metasearch
| dedup host sourcetype source
| fields host sourcetype source
| stats list(*) as *

[wrongquery]

No luck my friend