index=_internal host=abc123 source="metrics.log" group=tcpin_connections fwdType=uf
|dedup hostname
|table hostname
i am putting hostname= xyz578(output of above query) in the below query
index=* host=abc123 "xyz578"
but not getting any output
please help me with this missing part.
index=*
does not match index=_internal
. You need index=_*
to do that. Yeah, I know, not logical.
sorry but i didnt get it 😄
What did you not get?
index=_* should be a subset of index=*
asterik is not visible in the comment :-?
index=_(asterik)should be a subset of index=(asterik)
Agreed, but that's not how it works with indexes and Splunk. That's what I meant by "not logical".