It is very easy to obtain a more granular view of events split by the host where the events are occurring. All we need to do is add the by clause to the end of our previous Splunk search as follows:
index=main sourcetype=access_combined | eval GET_response=if(method=="GET",response,0) | eval POST_response=if(method=="POST",response,0) | timechart span=5m avg(GET_response) AS Avg_GET_Response, avg(POST_response) AS Avg_POST_Response, count(eval(method=="GET")) AS GET_Total, count(eval(method=="POST")) AS POST_Total, count AS Total_Visits by host
As simple as this is, we can now visualize values broken down by the host on which these values originated. In a distributed environment, this ...
