I have a field for device types (desktop or mobile) and a field for the hostname. Only a small number of events contain the device type field but all contain the host field. I need to create a field that contains all mobile hosts, but return all events related to them and not just the ones that contain the device type field. I have managed to get a list of all mobile hosts, but I don't know how to put them all into a field that is independent of the existence of the device class field.
To get a list of mobile hosts I use this search: (device_class=mobile | dedup host | stats values(host))
Hi @splunklearner1234,
This will filter on the hosts that are part of the device_class mobile and return all events :
index=whereYourDataIs [search device_class=mobile |dedup host |return 100 host ]
Let me know if that works out for you.
Cheers,
David
Hi @splunklearner1234,
This will filter on the hosts that are part of the device_class mobile and return all events :
index=whereYourDataIs [search device_class=mobile |dedup host |return 100 host ]
Let me know if that works out for you.
Cheers,
David
Thanks it works, although it is pretty slow.
Yeah, thats because of the subsearch. If you want to accelerate the results then the best approach would be to store your mobile hosts in a lookup file and use that instead 🙂
Ahh that's it. I've managed to create a lookup which is faster - thanks.