Splunk Search

Howto Chart Fields by Host

muebel
SplunkTrust
SplunkTrust

I am indexing results from facter which logs information about each host. I can get the most up to date list of these system properties by running

sourcetype="puppet-facts" | dedup host

This would return a single event for each host. My question is, how would I generate a table that would include a record for each host, and then columns consisting of the fields?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
sourcetype=puppet-facts 
| stats 
    first(field1) as field1 
    first(field2) as field2 
    first(field3) as field3
    count
    sum(field4) as total_amt
    ...
  by host

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
sourcetype=puppet-facts 
| stats 
    first(field1) as field1 
    first(field2) as field2 
    first(field3) as field3
    count
    sum(field4) as total_amt
    ...
  by host
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

sourcetype=puppet-facts | dedup host | table *

0 Karma

muebel
SplunkTrust
SplunkTrust

This works out nicely if I have a small amount of fields to create the table as I described. Do you know of a way to do the same thing for all fields? Other than just hardcoding it into the searchstring?

0 Karma

Simeon
Splunk Employee
Splunk Employee

Let's assume you have multiple fields values in your "puppet-facts" including duration and status. To chart any of these in combination with host, you could do the following search:

sourcetype="puppet-facts" | dedup host | chart count by host,duration,status

The above search uses the chart command to create a listing of the vent count with the host, duration, and status fields.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>