topic Re: How to write a simple search query to add another set of host name along with the current present host name? in Splunk Search

How to write a simple search query to add another set of host name along with the current present host name?

Hemnaath — Tue, 29 Sep 2020 14:23:08 GMT

Hi All, I have used the below query to capture the splunk service status (Up or Down) via splunkd.log. This query is working fine, but we have added few more splunk instance to the current environment and we need to capture these splunk service status along with the old splunk instances. My requirement is to include the newly build splunk host details to pull their service status.

Newly build host starts with the letter vms , so how to add this host name along with host name hs

Query details :
index=_internal host=hs* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures

thanks in advance.

Re: How to write a simple search query to add another set of host name along with the current present host name?

pragi_eashwar — Tue, 06 Jun 2017 11:33:45 GMT

Hi Hemanth

If the query is same just use the OR operator for the host like mentioned below,

index=------ host=hs* OR host=vms* -----query--------

Re: How to write a simple search query to add another set of host name along with the current present host name?

inventsekar — Tue, 29 Sep 2020 14:19:05 GMT

Hi Hemnaath, Please check -

index=_internal host=hs* OR host=vms* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures

Re: How to write a simple search query to add another set of host name along with the current present host name?

Hemnaath — Thu, 08 Jun 2017 12:48:06 GMT

thanks it worked, at same time could please tell me where we need to use OR operator and AND operator appropriately in SPL query. thanks in advance.