Can we run the query for 100 or so hosts?

danielbb — Mon, 09 Dec 2019 16:47:13 GMT

We have the following that runs nicely for one host -

index=<index name> host=<host name> source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
| stats first(MaximumProcessAddressSpace) as AvailableMEM 
| return AvailableMEM

We would like to do it for 100 or so hosts. Any ideas?

Re: Can we run the query for 100 or so hosts?

aberkow — Mon, 09 Dec 2019 19:52:01 GMT

Unclear if you're looking for something more complex, but running the stats command BY host should split this out by host. You can also inputlookup a csv that acts as an IN clause for specific hosts. Examples:

index=<index name>  source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
 | stats first(MaximumProcessAddressSpace) as AvailableMEM BY host

  index=<index name>  source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
[ |inputlookup hostsICareAbout.csv
    |table host]
    | stats first(MaximumProcessAddressSpace) as AvailableMEM BY host

Do these make sense as options/answer your question?

topic Re: Can we run the query for 100 or so hosts? in Splunk Search

Can we run the query for 100 or so hosts?

Re: Can we run the query for 100 or so hosts?