I got a strange situation here. I have two different searches as follows.
search 1:
index=* [ search index=_internal os=Windows sourcetype=splunkd
| stats count by hostname
| rename hostname as host
| fields host ]
| stats values(source) as sources by host
Which displays all the Windows hosts and sources of them for all the indexes.
And I have another search as follows which displays the results including Windows and also other operating systems which satisfies the same search condition.
search 2:
index=* | regex _raw!=".2016-\d{2}-\d{2}." | stats values(sources) as sources by host
Now I'm looking to write a search which displays the search 2 results from only the Windows hosts..I'm not sure if we have to include the search 1 for getting required result?
Any suggestions would be great and points will be awarded for the best answer
Try this
index=*
[ search index=_internal os=Windows sourcetype=splunkd
| stats count by hostname
| rename hostname as host
| fields host ]
| regex _raw!=".2016-\d{2}-\d{2}."
| stats values(source) as sources by host
Try this
index=*
[ search index=_internal os=Windows sourcetype=splunkd
| stats count by hostname
| rename hostname as host
| fields host ]
| regex _raw!=".2016-\d{2}-\d{2}."
| stats values(source) as sources by host
what if I want to display all the sourcetypes too for each host besides the sources?
You can add that too. Like this
index=*
[ search index=_internal os=Windows sourcetype=splunkd
| stats count by hostname
| rename hostname as host
| fields host ]
| regex _raw!=".2016-\d{2}-\d{2}."
| stats values(source) as sources values(sourcetype) as sourcetypes by host