topic Re: Specify More Than One Host? in Splunk Search

Specify More Than One Host?

eboniebutler — Thu, 29 Jan 2015 20:07:52 GMT

Hey everyone! I have a pretty simple question. Below is a sample search string:

index=os sourcetype=df mount="/etc" host=server1

Is there a way to specific more than one host? I thought I could get away with host=server1,server2 but it didn't work out. I'm trying to tailer my visualization chart for my clients as much as possible so it would help out to just display the data that actually matters to them.

Re: Specify More Than One Host?

reswob4 — Thu, 29 Jan 2015 20:09:28 GMT

Depends on how many hosts you want to specify. If it's two or three, simply using OR will do it:

index=os sourcetype=df mount="/etc" (host=server1 OR host=server2 OR host=server3)

If you get into too many hosts, then you may be able to sue a wildcard if they have similar names. If not, then you may have to use more esoteric means, like a lookup table.

Re: Specify More Than One Host?

thambisetty — Thu, 01 Mar 2018 05:09:20 GMT

you can do like below,

index=os sourcetype=df mount="/etc" host IN (server1,server2)

Re: Specify More Than One Host?

plantiw — Mon, 06 Aug 2018 18:27:27 GMT

so I am doing sourcetype cisco:asa and host=* but I am not getting all the hosts. Also how do I just get a report on hosts without all the log info?