https://community.splunk.com/t5/Splunk-Search/Why-does-quot-search-host-ComputerName-quot-return-all-results/m-p/179619#M51717 <P>I'm looking for Splunk Universal Forwarders that have a different name registered other than the actual host name. This usually happens when a server is renamed. When I execute the search below, I get back the same # of events as if I don't do the comparison. An export of the data to Excel with a simple comparison formula shows that out of the 2619 events returned there are actually 15 servers with old host names.</P> <P>Why doesn't the search return 15 events?</P> <PRE><CODE>index=machine sourcetype=WinHostMon source=os host=* ComputerName=* | search host!=ComputerName | table host ComputerName </CODE></PRE> Fri, 26 Jun 2015 22:36:47 GMT DamageSplunk 2015-06-26T22:36:47Z https://community.splunk.com/t5/Splunk-Search/Why-does-quot-search-host-ComputerName-quot-return-all-results/m-p/179619#M51717 <P>I'm looking for Splunk Universal Forwarders that have a different name registered other than the actual host name. This usually happens when a server is renamed. When I execute the search below, I get back the same # of events as if I don't do the comparison. An export of the data to Excel with a simple comparison formula shows that out of the 2619 events returned there are actually 15 servers with old host names.</P> <P>Why doesn't the search return 15 events?</P> <PRE><CODE>index=machine sourcetype=WinHostMon source=os host=* ComputerName=* | search host!=ComputerName | table host ComputerName </CODE></PRE> Fri, 26 Jun 2015 22:36:47 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-quot-search-host-ComputerName-quot-return-all-results/m-p/179619#M51717 DamageSplunk 2015-06-26T22:36:47Z https://community.splunk.com/t5/Splunk-Search/Why-does-quot-search-host-ComputerName-quot-return-all-results/m-p/179620#M51718 <P>Just like how in your base search <CODE>sourcetype=WinHostMon</CODE> is looking for the sourcetype field to match the string <CODE>WinHostMon</CODE> and not a field named WinHostMon, so your search is doing the same looking any host that is not the string ComputerName</P> <P>What you want instead is the <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/where">where command</A> which allows for more precision, and <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/CommonEvalFunctions">even lets you use useful functions</A> in comparisons!</P> <PRE><CODE>index=machine sourcetype=WinHostMon source=os host= ComputerName= | where host!=ComputerName | table host ComputerName </CODE></PRE> Fri, 26 Jun 2015 22:43:08 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-quot-search-host-ComputerName-quot-return-all-results/m-p/179620#M51718 acharlieh 2015-06-26T22:43:08Z