Splunk Search

Howto Chart Fields by Host

muebel
SplunkTrust
SplunkTrust

I am indexing results from facter which logs information about each host. I can get the most up to date list of these system properties by running

sourcetype="puppet-facts" | dedup host

This would return a single event for each host. My question is, how would I generate a table that would include a record for each host, and then columns consisting of the fields?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
sourcetype=puppet-facts 
| stats 
    first(field1) as field1 
    first(field2) as field2 
    first(field3) as field3
    count
    sum(field4) as total_amt
    ...
  by host

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
sourcetype=puppet-facts 
| stats 
    first(field1) as field1 
    first(field2) as field2 
    first(field3) as field3
    count
    sum(field4) as total_amt
    ...
  by host
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

sourcetype=puppet-facts | dedup host | table *

0 Karma

muebel
SplunkTrust
SplunkTrust

This works out nicely if I have a small amount of fields to create the table as I described. Do you know of a way to do the same thing for all fields? Other than just hardcoding it into the searchstring?

0 Karma

Simeon
Splunk Employee
Splunk Employee

Let's assume you have multiple fields values in your "puppet-facts" including duration and status. To chart any of these in combination with host, you could do the following search:

sourcetype="puppet-facts" | dedup host | chart count by host,duration,status

The above search uses the chart command to create a listing of the vent count with the host, duration, and status fields.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...