topic Re: Host Metrics with associated indexes in Splunk Search

Host Metrics with associated indexes

WebNerdNick — Wed, 18 Oct 2023 15:21:36 GMT

We're using this query to retrieve metrics on our hosts:

index=_internal source=*metrics.log group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | rename connectionType as connectType | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder") | eval version=if(isnull(version),"pre 4.2",version) | rename version as Ver | dedup sourceIp | table connectType, sourceIp, sourceHost, Ver

This gives us everything we need, except for what indexes these hosts are sending data to.

I'm aware of this query to retrieve the indexes and the hosts that are sending data to them:

|tstats values(host) where index=* by index

How can I combine the two, either with a join or a sub search where in the table output, we have a column for index, which would give us a list of indexes the hosts are sending to?

Re: Host Metrics with associated indexes

richgalloway — Wed, 18 Oct 2023 16:38:46 GMT

This should do it. It just runs both queries and uses the stats command to regroup the results.

Re: Host Metrics with associated indexes

WebNerdNick — Wed, 18 Oct 2023 16:43:06 GMT

In my results under the index column, all I get is "_internal".

Re: Host Metrics with associated indexes

richgalloway — Wed, 18 Oct 2023 16:48:59 GMT

Interesting. I see _internal and non-internal indexes when I run it on one of my sandboxes.

What do you see when you run the tstats query alone?

Re: Host Metrics with associated indexes

WebNerdNick — Wed, 18 Oct 2023 17:03:36 GMT

tstats alone gives me an index column with proper index names (not _index), and then I have a values(host) column that has large listings of the hostnames that send to the related index.

Re: Host Metrics with associated indexes

richgalloway — Wed, 18 Oct 2023 18:34:13 GMT

That sounds about right, although I would expect each index to be on a separate line with the corresponding index name. Do you have a screenshot?

Re: Host Metrics with associated indexes

WebNerdNick — Tue, 24 Oct 2023 18:20:23 GMT

I selected this answer as the solution. After coming back to this a few days later, it seems to be reporting what I was looking for. Not sure if there was some odd caching going on when I was testing over and over, but this at least gets me close to what I was looking for.