Getting Data In

How can I add the hosts to the search without it bringing up all the hosts in the index?

rgarbac1
New Member

I need to add the hosts to the search below, such as host = "servername". It currently brings up all the hosts in the index and I only need a few.

| metadata type=sources index=myindex | join source type=outer [ search index=myindex  AND fullload = "]I:  Task is running" 
| bucket span=1h _time 
| stats count  by  source,
 fullload 
| eval Date=strftime(_time,"%m/%d/%Y")]| sort + count| fillnull value=0 |where count = 0  |search TaskName = "*_T1" 
|fields TaskName, count
0 Karma

sushantmhatre
Explorer

you can create lookup of hosts and then filter group of hosts you are looking after

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...