Splunk Search

The difference in the number of events on different hosts

nalia_v
Loves-to-Learn Everything

How to find the difference of events between hosts ?
If the number of events on different hosts differs by 15 ?1.jpg

Labels (1)
Tags (1)
0 Karma

thambisetty
Super Champion

I didn’t say by hostname in eventstats

remove by hostname in eventstats

————————————
If this helps, give a like below.
0 Karma

thambisetty
Super Champion

If there are only two rows then you can use range. Add below search to your search.

| eventstats range(EventCount) as diff_event_count

| where diff_event_count=15

————————————
If this helps, give a like below.
0 Karma

nalia_v
Loves-to-Learn Everything

@thambisetty I will definitely like it 😃 if you can help with the request

The main request erased, I'm sorry, all the same data.
The request itself for the last hour was supposed to show by example the difference in events of 5 pieces. I took 5 as an example.2.png

In your version, I did not find this difference in 5 pieces.

3.png

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...