Splunk Search

Looking for a search to categorize by hosts..??

prakash007
Builder

I am expecting a single search to categorize by hosts with individual count and total count by category...

SET-A Count _time
host=web01 25
host=web02 55
SET-A Total 80

SET-B Count _time
host=web05 15
host=web06 20
SET-B-Total 35

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You can if you have that category column available in the logs OR can be added later (eval-case or lookup etc).

e.g.

your base search giving fields host, _time
| ...some logic to get category field there...
| bucket _time span=10m  ***assuming you want to bucket time. update as required***
| stats count by _time category host
| appendpipe [| stats sum(count) as count by _time category | eval category=category."- Total"]
| stats list(host) as host list(count) as count by _time category

View solution in original post

0 Karma

somesoni2
Revered Legend

You can if you have that category column available in the logs OR can be added later (eval-case or lookup etc).

e.g.

your base search giving fields host, _time
| ...some logic to get category field there...
| bucket _time span=10m  ***assuming you want to bucket time. update as required***
| stats count by _time category host
| appendpipe [| stats sum(count) as count by _time category | eval category=category."- Total"]
| stats list(host) as host list(count) as count by _time category
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...