How to put together a listing of hosts, forwarder version and Index the hosts belong to in a search?

[NanSplk01]

So far I can get the hosts and forwarder version, but I am unable to get the index the forwarders belong to:

index="_internal" source="*metrics.lo*" group=tcpin_connections fwdType=uf | dedup hostname| table hostname,version,os

How can I tie the above with the index that the hosts belong to?

[gcusello]

Hi @NanSplk01,

as @richgalloway said Hosts do not "belong" to an index.  Data is stored in indexes ("belongs" in the index).  Host is just one piece of metadata associated with an event.  It's possible for a given host to be in many events and, possibly, in many indexes."

You could correlate the information about index to the host using another search where your search is a part:

(index="_internal" source="*metrics.lo*" group=tcpin_connections fwdType=uf) OR (index=*)
| eval hostname=coalesce(hostname,host)
| stats 
   values(index) AS index 
   values(version) AS version 
   values(os) A os 
   BY hostname
| table hostname version os index

Ciao.

Giuseppe

[bray1111]

I found a typo in the search and the use of index=* is inefficient so I altered it slightly to use the 'per index thruput' group to get index info from the internal index.  I do see some field dropout in my environment but this works.

index="_internal" source="*metrics.lo*" (group=tcpin_connections fwdType=uf) OR group=per_index_thruput
| eval hostname=coalesce(hostname,host)
| stats
values(series) AS index
values(version) AS version
values(os) AS os
BY hostname
| table hostname version os index

[richgalloway]

Hosts do not "belong" to an index.  Data is stored in indexes ("belongs" in the index).  Host is just one piece of metadata associated with an event.  It's possible for a given host to be in many events and, possibly, in many indexes.