Is it possible to use Python (or other languages) to get logs that originated from specific hosts?

[sameratassi]

Hi,

Is it possible to use Python (or other languages) to get logs that originated from specific hosts?

For example, search for a list of hosts and return the logs that were ingested during a specific date range.

Thanks !   

[mayurr98]

Hello , if its a dynamic list of hosts you could create a lookup table for hosts using settings » Lookups » Lookup table files » New Table Lookup File.

and use below search 

index=<your_index> [inputlookup hosts.csv | table host ]

Select date range on the top right side of the search bar to get the appropriate results.

let me know if this helps!

[richgalloway]

The SPL for that would look something like this.

index=foo earliest=bar latest=baz [ 
  <<your search for a list of hosts>>
  | field host 
  | format
  ]

Crafting that in Python (or other languages) is an exercise left to the reader.