Reporting

Iterate a Search over a Collection of Variables?

muebel
SplunkTrust
SplunkTrust

Suppose I have a collection of hosts, and I have a search string that works really well when you specify only one host. This is a scheduled search that I would want to run, and one way of doing it seems to be to create a separate saved search for each host. I.E.

host=foo | awesome | search | pipe | line
host=baz | awesome | search | pipe | line
.
.
.
host=lastHost | awesome | search | pipe | line

Is there a good way of configuring splunk to replace the host=foo/baz/.../lastHost part with host=$currenthost and loop through the collection of hosts running the search each time for each host.

ftk
Motivator

Like dwaddle said you should be able to use map. You should be able to loop over the hosts in an index like this:

| metadata type=hosts index=blah | map maxsearches=50 search="search index=blah host=$host$ | awesome | search | pipe | line"

You will have to tune the maxsearches parameter to your number of hosts, of course.

ftk
Motivator

Yeah I tried it -- didn't know your exact search, so I just appended some search that I knew would bring me back unique results on each host to make sure it worked.

0 Karma

muebel
SplunkTrust
SplunkTrust

Did you run this? I tried with 3 hosts and it seems to report something. {CODE}| metadata type=hosts | map maxsearches=3 search="search host=$host$ minutesago=1" {CODE} produced some results--without a histogram-- and when I tried 15 hosts splunkd crashed hah

0 Karma

dwaddle
SplunkTrust
SplunkTrust

This seems like a good use for the map search command - but I'll be honest I've never come up with a working example of map that does anything useful.

I think for this to work you'd need to custom-script an input that has your list of hosts in it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...