Splunk Search

display count of hostnames in first day of week have last_seen>30 days

cipi23
New Member

for 08.07.19 count number of hostnames that have last_seen > 30 days
for 01.07.19 count number of hostnames that have last_seen > 30 days
for 24.06.19 count number of hostnames that have last_seen > 30 days
for 17.06.19 count number of hostnames that have last_seen > 30 days

the output will look like this
week1 count
week2 count
week3 count
week4 count

all this i need to do in one search please help

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

index=<You Should Always Specify index=> AND sourcetype=<And sourcetype= Too> AND (host= 08.07.19" OR host="01.07.19" OR host="24.06.19" OR host="17.06.19") earliest=-4w
| timechart useother=f usenull=f span=1w dc(last_seen) AS count BY host
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...