Splunk Search

Using inline REX to extract duplicate hosts, how do I identify the unique number of hosts reporting from a source?

stacejr
Engager

I am trying to identify the unique number of hosts reporting from a source. When the source is indexed, the host field sometimes is FQDN and sometimes is IP address. They are not duplicate entries, just different data/logs.

I have two separate searches, one that ignores the IP address hosts and delivers unique hosts as FQDN:

source="logsource"
| search host!="10.xxx"
| dedup host
| stats count by host

And one that uses the rex (I'm new to using this) option to pull the FQDN elsewhere in the log:

source="logsource"
| search host="10.xxx"
| rex field=_raw "leadingText,  (newhostfield.) trailingText"
| dedup newhostfield
| stats count by newhostfield, host

I want to combine the two lists in a search and dedup to give me a unique list of hosts from this log source.

Anyone able to point me in the right direction?
Thanks

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

source="logsource"
| rex field=_raw "leadingText,  (newhostfield.) trailingText"
| eval newhostfield=if(match(host,"^10\..+"),newhostfield,host)
| stats dc(newhostfield) as count by newhostfield, host
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...