might try doing a dns lookup on the server field, and then doing your | stats dc(client) by <dns_response>
Thusly:
index=ndx sourcetype=srctp clients=* server=* | lookup dnslookup server as dest OUTPUTNEW clienthost as dns_response | stats dc(clients) by dns_response You may need to configure dnslookup first.
September 04, 2020 at 03:10PM
via reddit https://www.reddit.com/r/Splunk/comments/iml040/combine_two_or_more_values_from_the_same_field/g40z9gj?utm_source=ifttt