topic Re: If I have servers with a host name format of host_1, host_2, host_3, etc, how can I search a range of hosts by hostname? in Splunk Search

If I have servers with a host name format of host_1, host_2, host_3, etc, how can I search a range of hosts by hostname?

idab — Tue, 29 Sep 2020 07:13:55 GMT

Hi,

I have 25 servers with the same prefix name and suffixed with different number host _1, host_2 ., ......, host_25.

How do you write a search to spool only the servers names from host_11 up to host_23? Instead of using the exclude operator (!=) on the hosts you don't need.

index=* counter="*"  Host="host _1*"    | eval Value = round(Value,1)| timechart  span=5m first(Value) by host

Re: If I have servers with a host name format of host_1, host_2, host_3, etc, how can I search a range of hosts by hostname?

richgalloway — Fri, 04 Sep 2015 20:34:06 GMT

Something like this?

index=* counter="*"  (Host="host_1*" OR Host="host_2*") | rex field=Host "host_(?<suffix>\d+)" | where suffix>10 AND suffix < 24 | eval Value = round(Value,1)| timechart  span=5m first(Value) by host

Re: If I have servers with a host name format of host_1, host_2, host_3, etc, how can I search a range of hosts by hostname?

somesoni2 — Fri, 04 Sep 2015 21:29:45 GMT

Assuming that your host name have same name with suffix as number (1,2,3...24,25) no left padding, try something like this

index= index=* counter="*"  [| gentimes start=-1 | eval Host=mvrange(11,24) | table Host | mvexpand Host | eval Host="YourHostSuffix_".Host ]    | eval Value = round(Value,1)| timechart  span=5m first(Value) by host

The subsearch will dynamically generate a OR condition as

Host=YourHostSuffix_11 OR Host=YourHostSuffix_12 OR.... OR Host=YourHostSuffix_23

. The only thing you need to provide is the suffix (YourHostSuffix above) and start index (11 in mvrange command) and End range (end range+1 =24 in mvrange).

Re: If I have servers with a host name format of host_1, host_2, host_3, etc, how can I search a range of hosts by hostname?

idab — Tue, 08 Sep 2015 15:45:27 GMT

Thanks richgallowway!

Re: If I have servers with a host name format of host_1, host_2, host_3, etc, how can I search a range of hosts by hostname?

idab — Tue, 08 Sep 2015 15:45:42 GMT

Thanks somesoni2

Re: If I have servers with a host name format of host_1, host_2, host_3, etc, how can I search a range of hosts by hostname?

ppablo — Wed, 09 Sep 2015 01:02:56 GMT

Hi @idab

Be sure to accept the answer that solved your question best, otherwise this will appear to other users as unresolved. Thanks!

Patrick

Re: If I have servers with a host name format of host_1, host_2, host_3, etc, how can I search a range of hosts by hostname?

cramasta — Fri, 11 Sep 2015 05:08:09 GMT

I saw someone else do this before was a bit surprised it even worked.

index= index=* counter="*"   (host=host_1* OR  host=host_2*)  (host >= host_1 AND host <= host_25)  | eval Value = round(Value,1)| timechart  span=5m first(Value) by host