Greetings @gbhw,
You're looking for the dc (distinct count) stats command. You can read more about stats commands here: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats
This is what you need for your search:
| stats dc(Host) as Host_Count dc(VulnerabilityId) as Vulnerability_Count by Service
| eval Vulnerabilites_Per_Host = Vulnerability_Count / Host_Count
Here's a full run-anywhere search demonstrating this with your sample data:
| makeresults | eval VulnerabilityId="123", Host="HostA", Service="Mail"
| append [ | makeresults | eval VulnerabilityId="234", Host="HostA", Service="Mail" ]
| append [ | makeresults | eval VulnerabilityId="345", Host="HostB", Service="Mail" ]
| append [ | makeresults | eval VulnerabilityId="123", Host="HostC", Service="HR" ]
| append [ | makeresults | eval VulnerabilityId="234", Host="HostC", Service="HR" ]
| stats dc(Host) as Host_Count dc(VulnerabilityId) as Vulnerability_Count by Service
| eval Vulnerabilites_Per_Host = Vulnerability_Count / Host_Count
... View more