topic Re: How to edit my type=host metadata search to exclude a certain index? in Getting Data In

How to edit my type=host metadata search to exclude a certain index?

hartfoml — Tue, 03 May 2016 18:26:55 GMT

I have this search:

| metadata type=hosts index=*a OR index=os index!=aruba

I want to get all the hosts in all the indexes except the aruba index.
The NOT command doesn't work either. How can I user the index-*a and not include the aruba index?

Re: How to edit my type=host metadata search to exclude a certain index?

somesoni2 — Tue, 03 May 2016 18:48:21 GMT

I would use tstats for this

| tstats count WHERE index=*a OR index=os index!=aruba by host

Re: How to edit my type=host metadata search to exclude a certain index?

hartfoml — Tue, 03 May 2016 18:54:49 GMT

thanks but I wanted to get the metadata like host, firstTime, lastTime, recentTime, totalCount

I keep all my ORG's in different indexes and was asked to provide states from each index along with metrics on each system

I don't know if i can get this from tstats? Or do I use tstats with the metadata search?

Re: How to edit my type=host metadata search to exclude a certain index?

javiergn — Tue, 03 May 2016 18:56:17 GMT

Try this:

| rest /services/data/indexes 
| rename title as indexname
| search indexname != aruba
| table indexname
| map maxsearches=99 search=" | metadata type=hosts index=\"$indexname$\" | eval index=\"$indexname$\" "

I have also added an index column in case that helps too.

NOTE I have assumed you don't have more than 99 indexes. If so feel free to increase the maxsearches value as it can't be unlimited I'm afraid.

Re: How to edit my type=host metadata search to exclude a certain index?

hartfoml — Tue, 03 May 2016 18:58:29 GMT

I tried the tstats and it is way slower than the metadata as it is actually doing a count

Re: How to edit my type=host metadata search to exclude a certain index?

somesoni2 — Tue, 03 May 2016 19:11:57 GMT

I would go with @Javiergn if you're looking for other metadata fields.

Re: How to edit my type=host metadata search to exclude a certain index?

hartfoml — Tue, 03 May 2016 19:18:00 GMT

I am testing this now. Why is it important to limit the maxsearches? wont this just return only the number of indexes that match the index= criteria?

Re: How to edit my type=host metadata search to exclude a certain index?

javiergn — Tue, 03 May 2016 19:35:46 GMT

If you don't specify maxsearches then it will default to 10 and map will only run for the first 10 indexes returned.
If you have more than 10 indexes then you are going to lose some results.

Re: How to edit my type=host metadata search to exclude a certain index?

hartfoml — Wed, 04 May 2016 14:50:32 GMT

this was the answer i used. I change the search just a little but this worked thanks

Re: How to edit my type=host metadata search to exclude a certain index?

moesaidi — Mon, 29 May 2017 17:22:37 GMT

I downvoted this post because this doesn't work

Re: How to edit my type=host metadata search to exclude a certain index?

woodcock — Tue, 11 Feb 2020 12:40:18 GMT

It helps to know the metadata command is essentially a macro around tstats. For the clueful, I will translate:
The firstTime field is min(_time).
The "astTime field is max(_time).
The recentTime field is max(_indextime).

Now you can build your own tstats-based search and have full control over what is searched (or not).

I commented about this here:
https://answers.splunk.com/answers/567047/metadata-showing-wrong-last-indexed-time.html?childToView=567064#answer-567064