topic Re: select subset of hosts in Splunk Search

select subset of hosts

BertKraan — Fri, 13 Sep 2013 11:46:49 GMT

Hello, splunk newbie here,

I have tens of servers named like abc01, abc02 .... abc20. Now i would like to search for events on a subset of these machines like for example only the abc18 and abc19. I'm trying searches like

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | regex "abc(18|19)"

This seems to work but how can i select data from everything except these "abc(18|19)" ?

host!="abc(18|19)"

doesn't seem to work..

Thanks in advance,

Bert

Re: select subset of hosts

somesoni2 — Fri, 13 Sep 2013 11:57:21 GMT

you can try using following query

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | search NOT ("abc18" OR "abc19")

Re: select subset of hosts

BertKraan — Fri, 13 Sep 2013 12:33:11 GMT

Will give it a try, thanks!

Re: select subset of hosts

zeroactive — Fri, 13 Sep 2013 14:02:51 GMT

I would use the following:

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now NOT host=abc18 NOT host=abc19

There's not a need to run a second search via the | operator, just go ahead and filter out those hosts in the first search command.