Ad slot: top

SPL

Count of Unique Hosts in Linux

Description

Submitted by SplunkNinja

The following splunk query example will return a unique count of hosts in a given time range *NOTE* if the host field is being autoextracted (for instance if you are using a universal forwarder) you will not need the regex command and can call upon the auto extracted fieldname of "host"
2 0
sourcetype=linux_secure |rex ".*:\d{2}\s(?<hostname>\S+)" | stats dc(hostname)

Comments

0 total

Be the first to comment on this SPL.

Leave a comment

You must log in to post a comment.

Ad slot: bottom