topic Re: How to create a search to find the matching host in a index from the list of hosts ? in Splunk Search

How to create a search to find the matching host in a index from the list of hosts ?

Woodpecker — Fri, 21 Oct 2022 11:45:33 GMT

Hi,

I have a list of hosts/devices say from HostA to HostZ (PS: its not a lookup file) I want to find out which host among the list show up in the particular index, say Index=IndexA.

Could someone help me on this?

Re: How to create a search to find the matching host in a index from the list of hosts ?

richgalloway — Fri, 21 Oct 2022 12:22:04 GMT

If the list of hosts is not a lookup file then in what form is it? That will make a difference in the search.

Re: How to create a search to find the matching host in a index from the list of hosts ?

gcusello — Fri, 21 Oct 2022 12:30:19 GMT

Hi @Woodpecker,

putting the list of hosts in a lookup is the easiest way to solve your problem.

If you haven't a lookup and this list isn't so log, you could une the IN operator, something like this:

index=indexA host IN (hostA, hostB, hostC ...,hostZ | ...

even if the lookup is the best solution!

Ciao.

Giuseppe

Re: How to create a search to find the matching host in a index from the list of hosts ?

PavelP — Fri, 21 Oct 2022 16:04:21 GMT

if you can define hosts using a wildcard (as in your example hostA to hostZ):

| metasearch index=IndexA host=host* | stats values(host) AS host

if host* is to broad then you can restrict it with | where host IN or similar