topic Re: spl query output mismatch in Splunk Search

spl query output mismatch

vinitpathri — Wed, 30 Sep 2020 04:59:57 GMT

index=_internal host=abc123 source="metrics.log" group=tcpin_connections fwdType=uf
|dedup hostname
|table hostname

i am putting hostname= xyz578(output of above query) in the below query

index=* host=abc123 "xyz578"
but not getting any output

please help me with this missing part.

richgalloway — Sat, 11 Apr 2020 17:13:51 GMT

index=* does not match index=_internal. You need index=_* to do that. Yeah, I know, not logical.

vinitpathri — Thu, 16 Apr 2020 08:18:15 GMT

sorry but i didnt get it 😄

richgalloway — Thu, 16 Apr 2020 11:21:35 GMT

What did you not get?

vinitpathri — Thu, 16 Apr 2020 11:26:46 GMT

index=_* should be a subset of index=*

vinitpathri — Thu, 16 Apr 2020 11:31:00 GMT

asterik is not visible in the comment :-?

index=_(asterik)should be a subset of index=(asterik)

richgalloway — Fri, 17 Apr 2020 11:18:01 GMT

Agreed, but that's not how it works with indexes and Splunk. That's what I meant by "not logical".