Splunk Search

How to use tstats to show unique list of hosts for a specified index?

russell120
Communicator

Hi, I'm using this search: | tstats count by host where index="wineventlog" to attempt to show a unique list of hosts in the wineventlog index.

But I get this error: Error in 'tstats' command: Invalid argument: 'index=wineventlog'

How do I form my search to use tstats (not stats) to return a unique list of hosts within a specific index? (in this case, wineventlog)?

Tags (4)
0 Karma
1 Solution

adamblock2
Path Finder

Try the following: | tstats count where index="wineventlog" by host.

View solution in original post

0 Karma

ddrillic
Ultra Champion

What about - | tstats count where index="wineventlog" by host? works for me ...

0 Karma

adamblock2
Path Finder

Try the following: | tstats count where index="wineventlog" by host.

0 Karma

russell120
Communicator

Perfect, thanks bro.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...