topic Re: foreach indexer iostats in Splunk Search

How come this doesn't work given indexers.csv is a list of Splunk servers with role indexer?

albledsoe — Wed, 22 Feb 2023 23:05:15 GMT

How come this doesn't work given indexers.csv is a list of Splunk servers with role Indexer?

Re: foreach indexer iostats

bowesmana — Wed, 22 Feb 2023 22:52:30 GMT

That is not what foreach is designed for. It looks like you want to run a search using the value of each splunk_server in your lookup, so use a subsearch like this

index=_introspection sourcetype=splunk_resource_usage component=IOStats [ | inputlookup indexers.csv | rename splunk_server as host ] | eval reads_ps = 'data.reads_ps' | eval writes_ps = 'data.writes_ps'

I have left out the last two avg() statements as that is not how eval works - eval is to perform an action on a single event. If you want to create averages, use some form of stats command, e.g.

| stats avg(write_ps) as writes_ps avg(reads_ps) as reads_ps by host

Re: foreach indexer iostats

albledsoe — Wed, 22 Feb 2023 23:21:15 GMT

Yep, that's it. It's been sometime since I wrote SPL. I had been using the REST API in Bash and Javascript. But many don't want to run my scripts. So I am trying to convert to copy/paste SPL. Thanks for the quick tutorial.