Splunk Search

How to add an additional column to my report (I need a hostname column).

agoktas
Communicator

Here is my search:

index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "\nName=(?PIBM.{1,})" | chart count by SvcName | rename SvcName as "Service Name"

And I need to add another column to the right of the "Service Name" column called "Host". This way I have the windows service name associated with the host that I'm looking for.

How do I adjust my search string to add this column to the statistics table view?

Thanks!

1 Solution

sideview
SplunkTrust
SplunkTrust

I think you just need.

index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "nName=(?PIBM.{1,})" | stats count by SvcName host | rename SvcName as "Service Name"

View solution in original post

sideview
SplunkTrust
SplunkTrust

I think you just need.

index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "nName=(?PIBM.{1,})" | stats count by SvcName host | rename SvcName as "Service Name"

agoktas
Communicator

Thank you so much! That works perfectly! Apparently I'm a total noob when it comes to tabl'ing out my results. 😉

0 Karma

sideview
SplunkTrust
SplunkTrust

no worries. Here's a link to give you some insight into the difference between the stats and chart commands - http://answers.splunk.com/answers/32001/difference-stats-and-chart.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...