Getting Data In

How can I add the hosts to the search without it bringing up all the hosts in the index?

rgarbac1
New Member

I need to add the hosts to the search below, such as host = "servername". It currently brings up all the hosts in the index and I only need a few.

| metadata type=sources index=myindex | join source type=outer [ search index=myindex  AND fullload = "]I:  Task is running" 
| bucket span=1h _time 
| stats count  by  source,
 fullload 
| eval Date=strftime(_time,"%m/%d/%Y")]| sort + count| fillnull value=0 |where count = 0  |search TaskName = "*_T1" 
|fields TaskName, count
0 Karma

sushantmhatre
Explorer

you can create lookup of hosts and then filter group of hosts you are looking after

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...