Splunk Search

How to search for and display all hosts that have more than 1 eventtype?

shellnight
Explorer

is there a way to search for more than 1 eventtype for a single host and display the same in a stats table

fields available are

hostsname
eventtype= eg disk full, disk crash, cpu high

need to display all hosts which have more than 1 eventtype .eg a hostname with both cpu high and disk full

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

index=foo | stats dc(eventtype) as eventCount by hostname | where eventCount > 1 | table hostname eventtype
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...