topic Re: Search multiple hosts with one search string in Splunk Search

Search multiple hosts with one search string

Xe03kfp — Mon, 25 Feb 2013 19:28:15 GMT

How would I search multiple hosts with one search string?

I have 6 hosts and want the results for all:

Search String:

index="rdpg"
( 2222222 dest_port="") OR (1111111 src_port="") OR ( 1111111 src_ip="") OR (2222222 dest_ip="")
| eval disconnect_time=if(match(_raw,"2222222"),_time,null()) 
| eval connect_time=if(match(_raw,"1111111"),_time,null())
| eval Ephemeral=if(isnotnull(disconnect_time),dest_port,Ephemeral) 
| eval Ephemeral=if(isnotnull(connect_time),src_port,Ephemeral)
| stats min(connect_time) as Connect max(disconnect_time) as Disconnect min(src_ip) as "Source IP" max(dest_ip) as "Destin ip" by Ephemeral
| eval Seconds=Disconnect-Connect | fieldformat Seconds=strftime('Seconds', "%s") 
| eval "Total Time"=tostring(Seconds,"duration") 
| where Seconds > 300 
| search Connect=* Disconnect=*
| appendpipe [stats sum(Seconds) as "Total Seconds" ]
| convert timeformat="%a %b-%d %Y "at" %H:%M:%S" ctime(Connect) ctime(Disconnect)

Hosts= Srv004 Srv005 Srv181 Srv192 Srv142 Srv181

Re: Search multiple hosts with one search string

herkalurk — Mon, 25 Feb 2013 19:33:10 GMT

AND operators could help in this situation

host="srv004" AND host="srv005" AND .....

Re: Search multiple hosts with one search string

Xe03kfp — Mon, 25 Feb 2013 19:35:17 GMT

Didn't work

Re: Search multiple hosts with one search string

herkalurk — Mon, 25 Feb 2013 19:49:29 GMT

Sorry, I should have said OR ...

host="srv004" OR host="srv005" OR .....

Re: Search multiple hosts with one search string

herkalurk — Mon, 25 Feb 2013 20:46:05 GMT

If you were to do that report on each host individually, in the time frame you're searching, you got results from each host? I only want to make sure that the fact you're only seeing 2 hosts isn't because the others don't have data.

Re: Search multiple hosts with one search string

msackett — Fri, 07 Aug 2015 15:56:22 GMT

How could you use wildcards in server name to get groups of host without typing each one in?

Re: Search multiple hosts with one search string

hari2139 — Thu, 22 Dec 2016 19:50:24 GMT

host="srv00*"

Re: Search multiple hosts with one search string

prabhu77749 — Wed, 18 Jan 2017 00:32:53 GMT

host=srv00* will give all hosts matching the wildcard.

Re: Search multiple hosts with one search string

bliscuit — Tue, 29 Sep 2020 22:21:28 GMT

You can also use the regex command to pipe a field through a regular expression.

For example:

index=bro sourcetype=bro_conn
| regex dest_ip="/(^127.)|(^192.168.)|(^10.)|(^172.1[6-9].)|(^172.2[0-9].)|(^172.3[0-1].)|(^::1$)|(^[fF][cCdD])/"

Re: Search multiple hosts with one search string

ryhluc01 — Tue, 29 Jan 2019 14:57:32 GMT

Thanks! This helped.

Re: Search multiple hosts with one search string

rammeduru — Thu, 15 Aug 2024 01:33:23 GMT

should use OR condition to include all hosts....host="srv004" OR host="srv005" OR