https://community.splunk.com/t5/Splunk-Search/Best-way-to-get-a-subset-of-metadata-results/m-p/60696#M14921 <P>well that was easy, Thanks. Forgot about using the regex command directly in search.</P> Thu, 14 Mar 2013 17:17:33 GMT sonicZ 2013-03-14T17:17:33Z https://community.splunk.com/t5/Splunk-Search/Best-way-to-get-a-subset-of-metadata-results/m-p/60694#M14919 <P>I am trying to get a truncated list of metadata, and cant seem to get the search recognized.<BR /> How can i filter certain hosts with a regex pattern against the hostfield returned by a simple metadata search?</P> <PRE><CODE> |metadata type=hosts index=main </CODE></PRE> <P>I've tried subsearches, and using various patterns such as this with no luck. </P> <PRE><CODE>rex field=host "(?P&lt;somehost&gt;somepattern)" </CODE></PRE> <P>Thanks</P> Thu, 14 Mar 2013 00:51:25 GMT https://community.splunk.com/t5/Splunk-Search/Best-way-to-get-a-subset-of-metadata-results/m-p/60694#M14919 sonicZ 2013-03-14T00:51:25Z https://community.splunk.com/t5/Splunk-Search/Best-way-to-get-a-subset-of-metadata-results/m-p/60695#M14920 <P>Append a regex command:</P> <PRE><CODE> ... | regex host="somepattern" </CODE></PRE> Thu, 14 Mar 2013 07:46:41 GMT https://community.splunk.com/t5/Splunk-Search/Best-way-to-get-a-subset-of-metadata-results/m-p/60695#M14920 martin_mueller 2013-03-14T07:46:41Z https://community.splunk.com/t5/Splunk-Search/Best-way-to-get-a-subset-of-metadata-results/m-p/60696#M14921 <P>well that was easy, Thanks. Forgot about using the regex command directly in search.</P> Thu, 14 Mar 2013 17:17:33 GMT https://community.splunk.com/t5/Splunk-Search/Best-way-to-get-a-subset-of-metadata-results/m-p/60696#M14921 sonicZ 2013-03-14T17:17:33Z