Getting Data In

How can I search for the field host with multiple values?

ddrillic
Ultra Champion

We ended up with an operation index that has two hosts per event, let's say aaa and bbb.
Searching for index=shortland host=aaa brings results but index=shortland host=bbb does not.

What can it be?

Tags (3)
0 Karma

woodcock
Esteemed Legend

If that search does not work, then your host field does really have both values. We will never get to the bottom of this unless you post an event. and your props.conf settings.

0 Karma

harishalipaka
Motivator

Hi @ddrillic

H can achieve with OR ,IN
EG:- host=aaa or host=bbb

host in ("aaa","bbb")

If my answer helped please accept answer or up vote

Thanks
Harish

ddrillic
Ultra Champion

Thank you @harishalipaka.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share a sample (sanitized) event, please?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ddrillic
Ultra Champion

No worries - speaking with the sales engineer who explained that one host value was indexed at index time and another one was discovered at search time. Apparently, only the index time value is searchable when searching against the host field.

0 Karma

ddrillic
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...