Splunk Enterprise Security

Trying to create a csv with time, count, and OS

mlozano09
Engager

Trying to create a csv file with information that includes the total count of systems, OS, and current time

| inputlookup managed_hosts
| get_os_cat(host_name, category)
| search category=server
| rename category AS os
| eval rel_time = now() - not sure if this is correct, but this will take the current time??

here is where I get a bit confused, I know that I need to keep OS, and current time, but when I run the command below I get rid of OS and the time

| stats count by host_name
| stats sum(count) as total
| table total os rel_time

not sure how to go about adding OS and time to the total count of servers eventually tabling the results
I want one column to show OS, one to show the time, and the last as count

I want to use this csv to build a trend graph over time that I will run the report on a weekly basis

Thank you for the help

0 Karma

efavreau
Motivator

the stats command dumps any information not asked for. You could try eventstats:
| eventstats sum(count) BY host_name AS Total

###

If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...