topic Re: i have to exclude particular host from this query? in Splunk Search

i have to exclude particular host from this query?

karthi2809 — Mon, 17 Apr 2017 11:05:17 GMT

| metadata type=hosts index=xx_prod| eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status

Re: i have to exclude particular host from this query?

kamlesh_vaghela — Mon, 17 Apr 2017 12:13:21 GMT

Hi karthi2809,

I'm not sure about to filter index=xx_prod but you can exclude particular host by using below query.

| metadata type=hosts | where host!="hostname"

I hope it will help you.

Re: i have to exclude particular host from this query?

adonio — Mon, 17 Apr 2017 12:13:34 GMT

| metadata type=hosts | search host!="YourHost" | eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status

Re: i have to exclude particular host from this query?

Ravan — Mon, 17 Apr 2017 12:17:40 GMT

Not sure if understand the question properly , but the the usual search NOT will work right ..?

| metadata type=hosts index=xx_prod| search NOT (host=host1 OR host=host2) |eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status