topic what needs to be added to modify my search to display only the windows hosts? in Splunk Search

what needs to be added to modify my search to display only the windows hosts?

pavanae — Wed, 31 Aug 2016 14:48:52 GMT

The following is my search query :-

index=* | regex _raw!=".2016-\d{2}-\d{2}." | stats values(host) as hosts

Also is there any way that I can see all the sources per host in which my search string satisfies?

Re: what needs to be added to modify my search to display only the windows hosts?

sundareshr — Wed, 31 Aug 2016 14:51:12 GMT

Try this

index=* | regex _raw!=".2016-\d{2}-\d{2}." | stats values(sources) as sources by host

Re: what needs to be added to modify my search to display only the windows hosts?

appache — Wed, 31 Aug 2016 15:07:52 GMT

index=* | regex _raw!=".2016-\d{2}-\d{2}." | stats list(source) as sources by host

Re: what needs to be added to modify my search to display only the windows hosts?

twinspop — Wed, 31 Aug 2016 15:25:45 GMT

Probably the best way to identify Windows hosts at search time would be to use tags. Settings -> Tags. Be sure to adjust permissions as required in your use case.

A more dynamic, but also more "expensive", method would be to use a subsearch on the _internal index:

index=* [ 
    search index=_internal os=Windows sourcetype=splunkd | 
    stats count by hostname | rename hostname as host | fields host ] | 
stats values(source) as sources by host

EDIT to add regex command:

index=* [ 
    search index=_internal os=Windows sourcetype=splunkd | 
    stats count by hostname | rename hostname as host | fields host ] | 
regex _raw!=".2016-\d{2}-\d{2}." |
stats values(source) as sources by host

Re: what needs to be added to modify my search to display only the windows hosts?

pavanae — Wed, 31 Aug 2016 17:15:39 GMT

by the above search I am able to see all the windows hosts and sources which is good. But I want to see the hosts and sources which satisfies the search string " index=* | regex _raw!=".2016-\d{2}-\d{2}." and then I need to filter the results by your search string . so is there any way that I can get the results by using both the search strings.

Re: what needs to be added to modify my search to display only the windows hosts?

twinspop — Wed, 31 Aug 2016 17:25:33 GMT

add your regex command before the stats command: index=* [
search index=_internal os=Windows sourcetype=splunkd |
stats count by hostname | rename hostname as host | fields host ] |
regex _raw!=".2016-\d{2}-\d{2}." | stats values(source) as sources by host