For the query :
host=aeperf01api02 Level="INFO" | stats count by AppDomain
I have following output
Web 4504
WebApi 180240
ComplianceWeb 9384
ReportingWeb 34152
ReferenceDataWeb 161710
SecurityMasterWeb 78878
Login 38514
I have 6 host like above, how to sort them in one query where I can present these output in rows and hosts in the column so that I can check what is the number of services hit by the particular host.
@JyotiP, instead of stats try the following chart
command. The over host
argument will put the host names in column and count by AppDomain
.
<YourBaseSearchWithIndexAndSourceType> host=aeperf* Level="INFO"
| chart count over host by AppDomain
PS: As best practice make sure you include index and sourcetype in your Base search which is missing in your Splunk Search example.
@JyotiP, instead of stats try the following chart
command. The over host
argument will put the host names in column and count by AppDomain
.
<YourBaseSearchWithIndexAndSourceType> host=aeperf* Level="INFO"
| chart count over host by AppDomain
PS: As best practice make sure you include index and sourcetype in your Base search which is missing in your Splunk Search example.
I want an image of the output.
For example, is this something like that?
host IN(aeperf01api02,AAA,BBB,CCC,DDD,EEE) Level="INFO"
| stats count by host,AppDomain