All Apps and Add-ons

SPLUNK nmon: Is it possible to have "OR" condition for "Optional: Filter hosts populating"?

samstar
Engager

Hi there,

Seems it not accept regex. I have tried , : ; and so on.

hosta* | hostb*

is it possible to have 2 filters by or condition?

Thanks

0 Karma
1 Solution

guilmxm
Influencer

Hello !

The optional filter input is a simple input text box which is designed to be used for filtering server names available upon selection.

It acts as a implicit "AND" boolean condition in addition with the "host" multiselect / dropdown forms, such that the query will be defined as:

<query> host=$host-filter$ $host$ 

In its design, the purpose is having a free text filter which you can use depending on the server naming convention, let's say that you use "lp*" for Linux Production servers, using this in the free form filter would populate the host form with only the relevant servers.

I will think about that and check how it could be improved without adding too much complexity in the design of the interfaces 😉

Kind regards,

Guilhem

View solution in original post

0 Karma

samstar
Engager

thanks Guilhem

0 Karma

guilmxm
Influencer

Hello !

The optional filter input is a simple input text box which is designed to be used for filtering server names available upon selection.

It acts as a implicit "AND" boolean condition in addition with the "host" multiselect / dropdown forms, such that the query will be defined as:

<query> host=$host-filter$ $host$ 

In its design, the purpose is having a free text filter which you can use depending on the server naming convention, let's say that you use "lp*" for Linux Production servers, using this in the free form filter would populate the host form with only the relevant servers.

I will think about that and check how it could be improved without adding too much complexity in the design of the interfaces 😉

Kind regards,

Guilhem

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...