Splunk Search

Sourcetype count per host

warmup031
Explorer

Hello,

I would like to Check for each host, its sourcetype and count by Sourcetype.
I tried host=* | stats count by host, sourcetype

But in fact I need all the sourcetypes to be set as column, and get the count by host for each sourcetype. Can you help ?

Many thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @warmup031,
did you tried?

index=your_index 
| stats count by sourcetype host

host=* isn't needed because all the events has the field host and use always the index in main search.

Ciao.
Giuseppe

View solution in original post

0 Karma

warmup031
Explorer

Hello gcusello and adonio, I already tried thèse search but my main problem is to set each sourcetype as a column, hosts as row and get sourcetype count valid for each host
Thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @warmup031,
did you tried?

index=your_index 
| stats count by sourcetype host

host=* isn't needed because all the events has the field host and use always the index in main search.

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @warmup031,
please, try this

index=wineventlog
| chart count OVER host BY sourcetype

Ciao.
Giuseppe

0 Karma

warmup031
Explorer

Wonderful, thank you very much Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

You're welcome!
Ciao and Next time.
Giuseppe

0 Karma

adonio
Ultra Champion

try this:

| tstats count as event_count where index=* by host sourcetype

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...