Getting Data In

How to put together a listing of hosts, forwarder version and Index the hosts belong to in a search?

NanSplk01
Path Finder

So far I can get the hosts and forwarder version, but I am unable to get the index the forwarders belong to:

index="_internal" source="*metrics.lo*" group=tcpin_connections fwdType=uf | dedup hostname| table hostname,version,os

How can I tie the above with the index that the hosts belong to?

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @NanSplk01,

as @richgalloway said Hosts do not "belong" to an index.  Data is stored in indexes ("belongs" in the index).  Host is just one piece of metadata associated with an event.  It's possible for a given host to be in many events and, possibly, in many indexes."

You could correlate the information about index to the host using another search where your search is a part:

(index="_internal" source="*metrics.lo*" group=tcpin_connections fwdType=uf) OR (index=*)
| eval hostname=coalesce(hostname,host)
| stats 
   values(index) AS index 
   values(version) AS version 
   values(os) A os 
   BY hostname
| table hostname version os index

Ciao.

Giuseppe

0 Karma

bray1111
Explorer

I found a typo in the search and the use of index=* is inefficient so I altered it slightly to use the 'per index thruput' group to get index info from the internal index.  I do see some field dropout in my environment but this works.

index="_internal" source="*metrics.lo*" (group=tcpin_connections fwdType=uf) OR group=per_index_thruput
| eval hostname=coalesce(hostname,host)
| stats
values(series) AS index
values(version) AS version
values(os) AS os
BY hostname
| table hostname version os index

richgalloway
SplunkTrust
SplunkTrust

Hosts do not "belong" to an index.  Data is stored in indexes ("belongs" in the index).  Host is just one piece of metadata associated with an event.  It's possible for a given host to be in many events and, possibly, in many indexes.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...