Iterate a Search over a Collection of Variables?

[muebel]

Suppose I have a collection of hosts, and I have a search string that works really well when you specify only one host. This is a scheduled search that I would want to run, and one way of doing it seems to be to create a separate saved search for each host. I.E.

host=foo | awesome | search | pipe | line
host=baz | awesome | search | pipe | line
.
.
.
host=lastHost | awesome | search | pipe | line

Is there a good way of configuring splunk to replace the host=foo/baz/.../lastHost part with host=$currenthost and loop through the collection of hosts running the search each time for each host.

[ftk]

Like dwaddle said you should be able to use map. You should be able to loop over the hosts in an index like this:

| metadata type=hosts index=blah | map maxsearches=50 search="search index=blah host=$host$ | awesome | search | pipe | line"

You will have to tune the maxsearches parameter to your number of hosts, of course.

[ftk]

Yeah I tried it -- didn't know your exact search, so I just appended some search that I knew would bring me back unique results on each host to make sure it worked.

[muebel]

Did you run this? I tried with 3 hosts and it seems to report something. {CODE}| metadata type=hosts | map maxsearches=3 search="search host=$host$ minutesago=1" {CODE} produced some results--without a histogram-- and when I tried 15 hosts splunkd crashed hah

[dwaddle]

This seems like a good use for the map search command - but I'll be honest I've never come up with a working example of map that does anything useful.

I think for this to work you'd need to custom-script an input that has your list of hosts in it.