Splunk Search

help on basic table

jip31
Motivator

Hello

I use the search below :

[| inputlookup host.csv 
    | table host] index="x" sourcetype="PerfmonMk:Process" process_name=chrome ("%_Processor_Time"=0) 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats  count(process_name) as Total by host
| sort -Total limit=10

I need to display host, SITE and Total fields
I m doing

   | table host SITE Total

But SITE doenst display
What I have to do please?

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

When you use stats in your query it will drop remaining fields. So try this | stats count(process_name) as Total, values(SITE) as SITE by host

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

When you use stats in your query it will drop remaining fields. So try this | stats count(process_name) as Total, values(SITE) as SITE by host

0 Karma

jip31
Motivator

Oh many thanks

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...