topic Re: Create field from small subset of events in Splunk Search

Create field from small subset of events

splunklearner12 — Fri, 31 May 2019 09:30:31 GMT

I have a field for device types (desktop or mobile) and a field for the hostname. Only a small number of events contain the device type field but all contain the host field. I need to create a field that contains all mobile hosts, but return all events related to them and not just the ones that contain the device type field. I have managed to get a list of all mobile hosts, but I don't know how to put them all into a field that is independent of the existence of the device class field.
To get a list of mobile hosts I use this search: (device_class=mobile | dedup host | stats values(host))

Re: Create field from small subset of events

DavidHourani — Fri, 31 May 2019 11:37:47 GMT

Hi @splunklearner1234,

This will filter on the hosts that are part of the device_class mobile and return all events :

index=whereYourDataIs [search device_class=mobile |dedup host |return 100 host ]

Let me know if that works out for you.

Cheers,
David

Re: Create field from small subset of events

splunklearner12 — Fri, 31 May 2019 13:27:16 GMT

Thanks it works, although it is pretty slow.

Re: Create field from small subset of events

DavidHourani — Fri, 31 May 2019 14:01:53 GMT

Yeah, thats because of the subsearch. If you want to accelerate the results then the best approach would be to store your mobile hosts in a lookup file and use that instead 🙂

Re: Create field from small subset of events

splunklearner12 — Fri, 31 May 2019 14:56:27 GMT

Ahh that's it. I've managed to create a lookup which is faster - thanks.