Splunk Search

How to edit my search to count the number of hosts per keyword?

smhsplunk
Communicator

Each host has a particular keyword (they are extracted by field extractor), some hosts share the same keywords.
I am trying to count the number of hosts per keywords. i.e.

keyword1, - Number of times it Appears in hosts
keyword2, - Number of times it Appears in hosts

I am doing this but it is giving me a very high count

index=main host="*" 
| search * keyword!="NULL" 
| stats count(host) as host_numbers by keyword 
0 Karma
1 Solution

sundareshr
Legend

What you need is distinct_count. Try this

index=main host="" 
| search keyword!="NULL" 
| stats dc(host) as host_numbers by keyword

View solution in original post

sundareshr
Legend

What you need is distinct_count. Try this

index=main host="" 
| search keyword!="NULL" 
| stats dc(host) as host_numbers by keyword
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...