Splunk Search

Search for ports by host

vumanhtai
Path Finder

Hi All!
What search commands can I use to get results like this?

alt text

Tags (1)

woodcock
Esteemed Legend

Like this:

... | stats first(status) BY host port
| stats list(port) AS port list(status) AS status BY host
0 Karma

niketn
Legend

@vumanhtai, multiple ips can be connecting to same port. So ideally you should have the result other way around

 <YourBaseSearch>
| eval port_status=port." - ".status
| stats values(port_status) as port_status by host
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

493669
Super Champion
...|stats list(port) as port, list(status) as status by host

OR

...|stats values(port) as port, values(status) as status by host

You can try this...
list() does not dedup while values() will dedup

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...