topic Re: Search Help - Add Index to this _internal Search - And combine hosts in Splunk Search

Search Help - Add Index to this _internal Search - And combine hosts

aferone — Tue, 11 Apr 2017 20:13:59 GMT

I would like to add which index each of these hosts comes from in this search.

index=_internal source=*/metrics.log component=Metrics host=*hf* group=tcpin* | top limit=10000 hostname host version os arch

I was trying to append a list of servers from just a normal "index=foo" search, but I couldn't get that working.

hostname                    host                            version os                  arch    count   percent
bar                         barhost1                        5.0.2   Windows x64          556    2.839632
                              barhost2

Sorry for the formatting.

Also, this search shows us which Heavy Forwarders each device is sending logs to. Instead of having a separate line for each Heavy Forwarder a device is sending to, I'd like to combine those values into 1 field per line, as shown above.

Thanks!

Re: Search Help - Add Index to this _internal Search - And combine hosts

masonmorales — Tue, 11 Apr 2017 23:38:36 GMT

I use an indexed field called, "splunk_forwarder" to identify my heavy forwarders. Using an indexed field allows me to see which HF sent an event, regardless of which sourcetype I'm looking at. Here's a blog post about it.

Re: Search Help - Add Index to this _internal Search - And combine hosts

aferone — Wed, 12 Apr 2017 18:44:56 GMT

But can you see which index that device is associated with?

Re: Search Help - Add Index to this _internal Search - And combine hosts

masonmorales — Mon, 17 Apr 2017 23:49:20 GMT

Yes, then you could do something like index=* splunk_forwarder=* | stats values(index) as indexes by splunk_forwarder

Re: Search Help - Add Index to this _internal Search - And combine hosts

aferone — Tue, 18 Apr 2017 14:07:40 GMT

But are you now searching all raw data that way? Instead of using _internal or summarized data?

Re: Search Help - Add Index to this _internal Search - And combine hosts

masonmorales — Fri, 13 Sep 2019 05:19:11 GMT

No, it just adds a new field to all events that get indexed that identifies the sending forwarder.