Getting Data In

How to filter out log volume data from certain hosts in my search?

raindrop18
Communicator

I have this search which is pulling a Splunk log volume usage report, but the index has logs from both production and lab environments, so I want filter out the hosts from the lab environment from this search. I have tried host=prd*, but that didn't work. Is there a way to filter by host name?

_internal source=*license_usage.log* type=Usage idx=web |   timechart  span=1h sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB
0 Karma
1 Solution

lguinn2
Legend

The "host" field for the internal log is the name of the Splunk host - not the name of the host where the data came from!
In the license_usage.log, the name for the field you want is h.

So try this:

index=_internal source=*license_usage.log type=usage idx=web h="prd*"
| etc...

View solution in original post

lguinn2
Legend

The "host" field for the internal log is the name of the Splunk host - not the name of the host where the data came from!
In the license_usage.log, the name for the field you want is h.

So try this:

index=_internal source=*license_usage.log type=usage idx=web h="prd*"
| etc...

raindrop18
Communicator

thanks a bunch, working as expected.

0 Karma

ppablo
Retired

Hi @raindrop18

I'm glad you were able to find what you needed with @lguinn's answer 🙂 Please don't forget to resolve this post by clicking "Accept" directly below her answer. Thanks!

Patrick

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...