Splunk Search
Highlighted

how to edit my search to display list of hosts instead of count?

Explorer

i have written the following search to generate list of sourcetype and indexes with host count, but i want to list all the hosts instead of count,
can you please help me in it....

|metasearch index=* | dedup index sourcetype host| stats dc(host) AS hostcount,values(sourcetype) AS stlist by index

alt text

please check the image where i want to chagne my query for list of hosts

0 Karma
Highlighted

Re: how to edit my search to display list of hosts instead of count?

Motivator

Change the dc(host) AS hostcount to values(host) AS hostvalues. Something like this:

|metasearch index=* | dedup index sourcetype host| stats values(host) AS hostvalues,values(sourcetype) AS stlist by index
0 Karma