Splunk Search

How to search for and display all hosts that have more than 1 eventtype?

shellnight
Explorer

is there a way to search for more than 1 eventtype for a single host and display the same in a stats table

fields available are

hostsname
eventtype= eg disk full, disk crash, cpu high

need to display all hosts which have more than 1 eventtype .eg a hostname with both cpu high and disk full

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

index=foo | stats dc(eventtype) as eventCount by hostname | where eventCount > 1 | table hostname eventtype
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...