Reporting

Iterate a Search over a Collection of Variables?

SplunkTrust
SplunkTrust

Suppose I have a collection of hosts, and I have a search string that works really well when you specify only one host. This is a scheduled search that I would want to run, and one way of doing it seems to be to create a separate saved search for each host. I.E.

host=foo | awesome | search | pipe | line
host=baz | awesome | search | pipe | line
.
.
.
host=lastHost | awesome | search | pipe | line

Is there a good way of configuring splunk to replace the host=foo/baz/.../lastHost part with host=$currenthost and loop through the collection of hosts running the search each time for each host.

Motivator

Like dwaddle said you should be able to use map. You should be able to loop over the hosts in an index like this:

| metadata type=hosts index=blah | map maxsearches=50 search="search index=blah host=$host$ | awesome | search | pipe | line"

You will have to tune the maxsearches parameter to your number of hosts, of course.

Motivator

Yeah I tried it -- didn't know your exact search, so I just appended some search that I knew would bring me back unique results on each host to make sure it worked.

0 Karma

SplunkTrust
SplunkTrust

Did you run this? I tried with 3 hosts and it seems to report something. {CODE}| metadata type=hosts | map maxsearches=3 search="search host=$host$ minutesago=1" {CODE} produced some results--without a histogram-- and when I tried 15 hosts splunkd crashed hah

0 Karma

SplunkTrust
SplunkTrust

This seems like a good use for the map search command - but I'll be honest I've never come up with a working example of map that does anything useful.

I think for this to work you'd need to custom-script an input that has your list of hosts in it.

0 Karma