https://community.splunk.com/t5/Splunk-Search/limiting-the-scope-of-index-in-a-metadata-search/m-p/45293#M10728 <P>is there another regex that you can use?</P><BR /> index="hosts*"<P></P> Wed, 20 Jul 2011 16:21:54 GMT fk319 2011-07-20T16:21:54Z https://community.splunk.com/t5/Splunk-Search/limiting-the-scope-of-index-in-a-metadata-search/m-p/45292#M10727 <P>I am using this search:</P> <PRE><CODE>| metadata index=* type=hosts | eval age = now()-lastTime | where age &gt; (2*86400) | sort age d | convert ctime(lastTime) | fields age,host,lastTime </CODE></PRE> <P>which works great in showing me systems that have not forwarded anything in two days. However, one of my co-workers is playing around with a temp_index into which he is importing data from another splunk instance from which he exported some old logs. This index has hosts in it which are no longer forwarders, and I thought that perhaps I could add after <CODE>index=* NOT index=temp_index</CODE> -- but, alas, this does not work. I could, I suppose list all of the indexes I want but then I'd have to change the saved search every time I add a new index, which I will be doing over the next few months. Seems like there should be a way to do this. Anyone know how?</P> Mon, 28 Sep 2020 09:44:45 GMT https://community.splunk.com/t5/Splunk-Search/limiting-the-scope-of-index-in-a-metadata-search/m-p/45292#M10727 wrangler2x 2020-09-28T09:44:45Z https://community.splunk.com/t5/Splunk-Search/limiting-the-scope-of-index-in-a-metadata-search/m-p/45293#M10728 <P>is there another regex that you can use?</P><BR /> index="hosts*"<P></P> Wed, 20 Jul 2011 16:21:54 GMT https://community.splunk.com/t5/Splunk-Search/limiting-the-scope-of-index-in-a-metadata-search/m-p/45293#M10728 fk319 2011-07-20T16:21:54Z