List of unique sourceHosts in a sourceCategory

Follow

David Day

• August 04, 2019 02:44

I am trying to get a list of IP addresses that are reporting to a particular sourceCategory.   I have tried several options and the best I can come up with is:

_sourceCategory=prod/network
| count_frequent(_sourceHost)

However, I don't need the count of messages and that is extremely taxing on the server but I have not found another way to get the list of sourceHosts.

Thanks.

 

0

• Official comment

  

  Graham Watts

  • August 05, 2019 04:16

  Hey David,
  
  
  Can you try this query and let us know if this is what you're trying to see?

  _sourceCategory=prod/network
  | count by _sourceHost // assuming these are the source IPs
  | count by _sourceHost

  This is a trick to get a similar output of the count_distinct operator but is a bit faster.

  Comment actions Permalink
• 

  David Day

  • August 05, 2019 13:08

  Graham,

       Thanks.  That was exactly what I was looking for.

  0

  Comment actions Permalink

Please sign in to leave a comment.