Ack, seems I forgot to rename the hostname field to hosts, thus ruining the stats. (index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2)
| rename device.hostname as host...
See more...
Ack, seems I forgot to rename the hostname field to hosts, thus ruining the stats. (index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2)
| rename device.hostname as hosts
| rename device.username as username
| eval hosts = lower(hosts)
| stats values(*) as * by hosts
| table hosts, username, vendors, products, versions The trick is to get the hosts values (e.g. HOST1 and host1) to be in the same case (hence the lower()), then if you do "stats values(*) as * by host" , then it will put together all the values for the other columns on one row for each unique value of hosts. One for host1, one for host2, and so on.