Deployment Architecture

Determine host of the searchhead running a SPL

koshyk
Super Champion

hi,
we have savedsearches running on Search Heads and need to trigger different alerts based on the environment. The SPL in the savedsearch uses tstats and hence it doesn't have event information but rather statistics only. ( i could have used splunk_server variable to determine if it was events). We do have standards for production environment for hostname (eg starts with p) and we need to determine a logic based on the hostname environment

|tstats count as eventCount by host| <eval hostname of the search head> | search sh_hostname=p* | ...

is there any clever way to integrate hostname of the current search-head into the above search?

0 Karma

woodcock
Esteemed Legend

You can do it like this:

| makeresults | addinfo | map [|rest/services/search/jobs/$info_sid$] | table searchProviders splunk_server
| rename COMMENT AS "I believe these will both always be the same value: that of your Search Head"
| search splunk_server="YourServerThatShouldRunThisSearch"
| map [search Your Real Search Here]
0 Karma

koshyk
Super Champion

is the $info_sid$ need to be populated? from the above query, the rest endpoint shows me all the search providers just not the search-head where it is running

0 Karma

gjanders
SplunkTrust
SplunkTrust

Perhaps you could provide more detail as to why the search head running the query changes the query in some way...also did you try groupby splunk_server on the tstats query?

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma

koshyk
Super Champion

the Search Head won't change the query, but based on the environment/hostname we need to trigger different alert/severity

0 Karma

gjanders
SplunkTrust
SplunkTrust

eval or another conditional function of eval could work here...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!