Getting Data In

How can I add the hosts to the search without it bringing up all the hosts in the index?

New Member

I need to add the hosts to the search below, such as host = "servername". It currently brings up all the hosts in the index and I only need a few.

| metadata type=sources index=myindex | join source type=outer [ search index=myindex  AND fullload = "]I:  Task is running" 
| bucket span=1h _time 
| stats count  by  source,
| eval Date=strftime(_time,"%m/%d/%Y")]| sort + count| fillnull value=0 |where count = 0  |search TaskName = "*_T1" 
|fields TaskName, count
0 Karma


you can create lookup of hosts and then filter group of hosts you are looking after

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!