When we on board several servers into our Splunk instance, we install and turn on the Universal Forwarder for testing connectivity with the indexer. To do this, we search with the server name in the search head against the _internal index. If we have 5 or more servers, we usually make a lookup table and use the search:
index=_internal [| inputlookup server_table.csv]
To save time, i would like to create a dashboard where you enter a comma separated string in a text box, and in the search, parse out the servers and use them in a search. I can accomplish this with this search:
index=_internal sourcetype=splunkd earliest=-1m@m latest=now
| join type=inner host
[ search
| eval host=""
| makemv delim="," host
| mvexpand host]
| dedup host
| stats values(host)
But this only returns the servers that are connecting to Splunk indexer. I would like the search to report on those the are connected and those that are not. I have tried the "appendcols" command, but had no luck. Can anybody tell me how to parse a string into fields to use in a search? Thank you.
