Splunk Search

List the count of hosts by index for each day- My search gave me the right format but incorrect number?

HX
Engager

I would like to get the number of hosts per index in the last 7 days, the query as below gave me the format but not the correct number.

 

| tstats dc(host) where index=* by _time index | timechart span=1d dc(host) by index

Any idea? Thanks!

 

                        Index A Index B Index C Index D Index E Index F Index G Index H Index I Index J
2022-10-05 0               0                0             0               0             0              0              0           0            0 
2022-10-06 0               0                0             0               0             0              0              0           0            0
2022-10-07 0               0                0             0               0             0              0              0           0            0
2022-10-08 0               0                0             0               0             0              0              0           0            0
2022-10-09 0               0                0             0               0             0              0              0           0            0
2022-10-10 0               0                0             0               0             0              0              0           0            0

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Your first dc(host) makes a field called 'dc(host)' - it's no longer host. And you don't have a host field anyway from tstats, so you just need to take the values of the hosts field (named from the dc(host) aggregation).

| tstats dc(host) as hosts where index=* by _time index span=1d
| timechart span=1d values(hosts) by index

Note that the span=1d should be common to both tstats and timechart, because as you're not retaining the host name after tstats, you cannot do a dc() in the timechart

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your first dc(host) makes a field called 'dc(host)' - it's no longer host. And you don't have a host field anyway from tstats, so you just need to take the values of the hosts field (named from the dc(host) aggregation).

| tstats dc(host) as hosts where index=* by _time index span=1d
| timechart span=1d values(hosts) by index

Note that the span=1d should be common to both tstats and timechart, because as you're not retaining the host name after tstats, you cannot do a dc() in the timechart

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...