https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271841#M52215 <P>thanks a bunch, working as expected.</P> Tue, 15 Dec 2015 20:24:24 GMT raindrop18 2015-12-15T20:24:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271839#M52213 <P>I have this search which is pulling a Splunk log volume usage report, but the index has logs from both production and lab environments, so I want filter out the hosts from the lab environment from this search. I have tried <CODE>host=prd*</CODE>, but that didn't work. Is there a way to filter by host name?</P> <PRE><CODE>_internal source=*license_usage.log* type=Usage idx=web | timechart span=1h sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB </CODE></PRE> Mon, 14 Dec 2015 21:25:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271839#M52213 raindrop18 2015-12-14T21:25:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271840#M52214 <P>The "host" field for the internal log is the name of the Splunk host - not the name of the host where the data came from! <BR /> In the license_usage.log, the name for the field you want is <CODE>h</CODE>.</P> <P>So try this:</P> <PRE><CODE>index=_internal source=*license_usage.log type=usage idx=web h="prd*" | etc... </CODE></PRE> Tue, 15 Dec 2015 00:03:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271840#M52214 lguinn2 2015-12-15T00:03:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271841#M52215 <P>thanks a bunch, working as expected.</P> Tue, 15 Dec 2015 20:24:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271841#M52215 raindrop18 2015-12-15T20:24:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271842#M52216 <P>Hi @raindrop18</P> <P>I'm glad you were able to find what you needed with @lguinn's answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Please don't forget to resolve this post by clicking "Accept" directly below her answer. Thanks!</P> <P>Patrick</P> Thu, 17 Dec 2015 00:21:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-log-volume-data-from-certain-hosts-in-my/m-p/271842#M52216 ppablo 2015-12-17T00:21:53Z