https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128447#M34862 <P>You can do something like adding the following after the end:</P> <P><CODE>| where host="abc*"</CODE></P> <P>You're going to have to add <CODE>index</CODE> to the list of fields in your <CODE>fields</CODE> command if you want to be able to filter on those, though.</P> Wed, 17 Sep 2014 14:53:49 GMT aweitzman 2014-09-17T14:53:49Z https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128445#M34860 <P>The search string I am currently using is the following:</P> <P>| metadata type=hosts |where recentTime &lt; now() - 86400 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen | sort - lastSeen</P> <P>I would like to be able to use that as a base search but be able to append some more specific filters such as:</P> <P>host=abc*</P> <P>index=dns</P> <P>The first command that came to mind was adding a pipe search at the end, but that doesn't seem to work properly. I know this may be elementary for some of you Splunkers out there, but can anyone offer a quick hand? Much appreciated!</P> <P>Brian</P> Wed, 17 Sep 2014 14:46:17 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128445#M34860 ebdavis333 2014-09-17T14:46:17Z https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128446#M34861 <P>You can append the following</P> <PRE> |search host=abc* </PRE> Wed, 17 Sep 2014 14:53:40 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128446#M34861 pradeepkumarg 2014-09-17T14:53:40Z https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128447#M34862 <P>You can do something like adding the following after the end:</P> <P><CODE>| where host="abc*"</CODE></P> <P>You're going to have to add <CODE>index</CODE> to the list of fields in your <CODE>fields</CODE> command if you want to be able to filter on those, though.</P> Wed, 17 Sep 2014 14:53:49 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128447#M34862 aweitzman 2014-09-17T14:53:49Z https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128448#M34863 <P>I was doing this yesterday and it didn't seem to return any results, but works today. Thanks all for your contributions!</P> Wed, 17 Sep 2014 17:01:16 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-for-specific-hosts-or-indexes/m-p/128448#M34863 ebdavis333 2014-09-17T17:01:16Z