Getting Data In

How to create this search?

NanSplk01
Communicator

I need to create a search (or an embedded search that feeds data to another search.  What I'm trying to get is a search like  |tstats values(host) where index=* by index which might feed to a spread sheet that has server and host and then another search on top of it to match up host with index. (NOT indexers)

|tstats values(host) where index=* by index
Labels (2)
0 Karma
1 Solution

NanSplk01
Communicator

Thank you, used part of this with a search, but had to get some assistance.  The final search looked a little like this--did not use two searches, just one:

index=_internal source=*metrics.log group=tcpin_connections
| eval sourceHost=lower(if(isnull(hostname), sourceHost,hostname))
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| join sourceHost
[|tstats values(host) where index=* NOT index=*** NOT index=***| rename values(host) as host
| mvexpand host
| dedup host index
| eval sourceHost= lower(host)
| fields - host]
| dedup sourceHost connectType version
| table sourceHost connectType version
| sort index

 

Hopes this helps anyone else who needs to combine information from two searches.

View solution in original post

0 Karma

nyc_jason
Splunk Employee
Splunk Employee

Hello, so are you looking to output a table of host and index to show what hosts are in each index? If so, try this: |tstats count where index=* by host index|fields - count

0 Karma

NanSplk01
Communicator

Thank you, used part of this with a search, but had to get some assistance.  The final search looked a little like this--did not use two searches, just one:

index=_internal source=*metrics.log group=tcpin_connections
| eval sourceHost=lower(if(isnull(hostname), sourceHost,hostname))
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| join sourceHost
[|tstats values(host) where index=* NOT index=*** NOT index=***| rename values(host) as host
| mvexpand host
| dedup host index
| eval sourceHost= lower(host)
| fields - host]
| dedup sourceHost connectType version
| table sourceHost connectType version
| sort index

 

Hopes this helps anyone else who needs to combine information from two searches.

0 Karma
Get Updates on the Splunk Community!

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...