Getting Data In

How can I add the hosts to the search without it bringing up all the hosts in the index?

rgarbac1
New Member

I need to add the hosts to the search below, such as host = "servername". It currently brings up all the hosts in the index and I only need a few.

| metadata type=sources index=myindex | join source type=outer [ search index=myindex  AND fullload = "]I:  Task is running" 
| bucket span=1h _time 
| stats count  by  source,
 fullload 
| eval Date=strftime(_time,"%m/%d/%Y")]| sort + count| fillnull value=0 |where count = 0  |search TaskName = "*_T1" 
|fields TaskName, count
0 Karma

sushantmhatre
Explorer

you can create lookup of hosts and then filter group of hosts you are looking after

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...