-1

How can I get unique value number for below.

SeqNum<number>, by host name.

Appreciate your help in advance

Thank you

I tried

| Search SeqNum<*>
| Stats count by host

Getting table and total value by host but not getting unique number value

PM 77-1
  • 12,933
  • 21
  • 68
  • 111

2 Answers2

0

Assuming that you are looking for a count of unique "SeqNum" numbers you can do something like following:

| search SeqNum<*>
| rex "SeqNum\<(?<number>\d+)\>"
| stats count as total, dc(number) as unique_numbers by host
PM 77-1
  • 12,933
  • 21
  • 68
  • 111
0

| stats count by host | streamstats count as seqnum

This will give a unique sequence number for each host