Splunk Search

List the count of hosts by index for each day- My search gave me the right format but incorrect number?

HX
Engager

I would like to get the number of hosts per index in the last 7 days, the query as below gave me the format but not the correct number.

 

| tstats dc(host) where index=* by _time index | timechart span=1d dc(host) by index

Any idea? Thanks!

 

                        Index A Index B Index C Index D Index E Index F Index G Index H Index I Index J
2022-10-05 0               0                0             0               0             0              0              0           0            0 
2022-10-06 0               0                0             0               0             0              0              0           0            0
2022-10-07 0               0                0             0               0             0              0              0           0            0
2022-10-08 0               0                0             0               0             0              0              0           0            0
2022-10-09 0               0                0             0               0             0              0              0           0            0
2022-10-10 0               0                0             0               0             0              0              0           0            0

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Your first dc(host) makes a field called 'dc(host)' - it's no longer host. And you don't have a host field anyway from tstats, so you just need to take the values of the hosts field (named from the dc(host) aggregation).

| tstats dc(host) as hosts where index=* by _time index span=1d
| timechart span=1d values(hosts) by index

Note that the span=1d should be common to both tstats and timechart, because as you're not retaining the host name after tstats, you cannot do a dc() in the timechart

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your first dc(host) makes a field called 'dc(host)' - it's no longer host. And you don't have a host field anyway from tstats, so you just need to take the values of the hosts field (named from the dc(host) aggregation).

| tstats dc(host) as hosts where index=* by _time index span=1d
| timechart span=1d values(hosts) by index

Note that the span=1d should be common to both tstats and timechart, because as you're not retaining the host name after tstats, you cannot do a dc() in the timechart

0 Karma

PeterD1
New Member

we want to alert when an indexs host count drops by a significant amount... lets say 25%. how would this work? id be struggling to dynamically calculate this based on indexes that are present

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This sounds like a significantly different question - please start a new topic with more specifics as to your usecase, e.g. 25% of what over what time period, etc. Ideally, also provide your expected output.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...