Search code examples
sumhostsplunk

Sum of count with Splunk

First let me say that I am very very very new to splunk. I am trying to find all the "host" that make up an index and get a total count of unique values. The purpose of this is to eventually get alerts on when the total "host" changes so I can tell when something that makes up and index stops working.

Here is my query so far which gives me the host names and the count however I cannot figure out how to get the sum of "count"

index=exchangesmtp | table host | dedup host | stats count by host | addtotals fieldname=count
Solution

  • earliest=-30m index=exchangesmtp | dedup host | table host | stats count

    This is exactly what I was looking for.