we have savedsearches running on Search Heads and need to trigger different alerts based on the environment. The SPL in the savedsearch uses tstats and hence it doesn't have event information but rather statistics only. ( i could have used splunk_server variable to determine if it was events). We do have standards for production environment for hostname (eg starts with p) and we need to determine a logic based on the hostname environment
|tstats count as eventCount by host| <eval hostname of the search head> | search sh_hostname=p* | ...
is there any clever way to integrate hostname of the current search-head into the above search?
You can do it like this:
| makeresults | addinfo | map [|rest/services/search/jobs/$info_sid$] | table searchProviders splunk_server | rename COMMENT AS "I believe these will both always be the same value: that of your Search Head" | search splunk_server="YourServerThatShouldRunThisSearch" | map [search Your Real Search Here]
Perhaps you could provide more detail as to why the search head running the query changes the query in some way...also did you try groupby splunk_server on the tstats query?