Splunk Search

How to filter my search to only list values for a field that contain more than one host?

varma365
New Member

Here is a simple question. The following is my search:

index="atg" sessionId="*mob" host="*" | stats values(host) as hosts,values(source) as sources by sessionId 

Now I want to list out the sessionId values which contain more than one host or one source. How can I filter the results?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Add a dc(host) to the search, then filter off that key.

 index="atg" sessionId="*mob" host="*"
 | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId 
 | where hostcount > 1
0 Karma

shivarpith
Path Finder

how do we write this query in case on SPlunk Enterprise Security

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...