Deployment Architecture
Highlighted

Determine host of the searchhead running a SPL

Super Champion

hi,
we have savedsearches running on Search Heads and need to trigger different alerts based on the environment. The SPL in the savedsearch uses tstats and hence it doesn't have event information but rather statistics only. ( i could have used splunk_server variable to determine if it was events). We do have standards for production environment for hostname (eg starts with p) and we need to determine a logic based on the hostname environment

|tstats count as eventCount by host| <eval hostname of the search head> | search sh_hostname=p* | ...

is there any clever way to integrate hostname of the current search-head into the above search?

0 Karma
Highlighted

Re: Determine host of the searchhead running a SPL

SplunkTrust
SplunkTrust

Perhaps you could provide more detail as to why the search head running the query changes the query in some way...also did you try groupby splunk_server on the tstats query?

0 Karma
Highlighted

Re: Determine host of the searchhead running a SPL

Super Champion

the Search Head won't change the query, but based on the environment/hostname we need to trigger different alert/severity

0 Karma
Highlighted

Re: Determine host of the searchhead running a SPL

SplunkTrust
SplunkTrust

eval or another conditional function of eval could work here...

0 Karma
Highlighted

Re: Determine host of the searchhead running a SPL

Esteemed Legend

You can do it like this:

| makeresults | addinfo | map [|rest/services/search/jobs/$info_sid$] | table searchProviders splunk_server
| rename COMMENT AS "I believe these will both always be the same value: that of your Search Head"
| search splunk_server="YourServerThatShouldRunThisSearch"
| map [search Your Real Search Here]
0 Karma
Highlighted

Re: Determine host of the searchhead running a SPL

Super Champion

is the $info_sid$ need to be populated? from the above query, the rest endpoint shows me all the search providers just not the search-head where it is running

0 Karma