Splunk Search

How do you count the total # of hostnames and the total # when that value is blank.?

DEAD_BEEF
Builder

I have network logs and sometimes the DNS name is there, and sometimes it isn't. I am struggling to create a simple table that shows me the total # of hostnames when there is a value and the total # when it is blank.

sample data

host       hostname
1.1.1.1    host-1.com
2.2.2.2
3.3.3.3    host-3.com
4.4.4.4    host-4.com
5.5.5.5

desired output

Named    Blank
3        2

current query

| tstats count where index=network by host prestats=t
| lookup dnslookup clientip as host OUTPUT clienthost as hostname
| eventstats count(eval(NOT hostname="*")) AS Blank count(eval(hostname="*")) AS Named by hostname

final working query

| tstats count where index=network by host 
| lookup dnslookup clientip as host OUTPUT clienthost as hostname
| stats count(eval(isnull(fqdn))) AS Blank count(eval(isnotnull(fqdn))) AS Named 
0 Karma
1 Solution

whrg
Motivator

Try it like this:

... | stats count(eval(isnull(hostname))) AS Blank count(eval(isnotnull(hostname))) AS Named

View solution in original post

0 Karma

whrg
Motivator

Try it like this:

... | stats count(eval(isnull(hostname))) AS Blank count(eval(isnotnull(hostname))) AS Named
0 Karma

DEAD_BEEF
Builder

That worked perfectly, thanks @whrg! I was going in circles with eventstats.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...