i have written the following search to generate list of sourcetype and indexes with host count, but i want to list all the hosts instead of count,
can you please help me in it....
|metasearch index=* | dedup index sourcetype host| stats dc(host) AS hostcount,values(sourcetype) AS stlist by index
please check the image where i want to chagne my query for list of hosts
Change the dc(host) AS hostcount
to values(host) AS hostvalues
. Something like this:
|metasearch index=* | dedup index sourcetype host| stats values(host) AS hostvalues,values(sourcetype) AS stlist by index