Hi All
Is it possibile have\build a report with the fileds in title message?
CLIENT, CLIENT_Queries and FQDN Queried
I try to create it "merging" in some way two existing reports wich have the fields and information needed:
DNS Top Client (without the splunk code to obtain TOP) and
DNS Domain Queried by Client
Some like this:
index=ib_dns_summary | lookup dns_viewkey_displayname_lookup VIEW output display_name | stats sum(COUNT) as FQDN_TOTAL by FQDN |stats sum(COUNT) as CLIENT_QUERIES by CLIENT |eventstats sum(CLIENT_QUERIES) as TotCLIENT | eventstats sum(FQDN_TOTAL) as TOTAL| rename FQDN_TOTAL as Count, FQDN as "Domain Name" | fields "Domain Name", Count, TotCLIENT
But the result is a standard event
Thanks in advance
