Splunk Search

Best way to get a subset of metadata results

sonicZ
Contributor

I am trying to get a truncated list of metadata, and cant seem to get the search recognized.
How can i filter certain hosts with a regex pattern against the hostfield returned by a simple metadata search?

 |metadata type=hosts index=main

I've tried subsearches, and using various patterns such as this with no luck.

rex field=host "(?P<somehost>somepattern)"

Thanks

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Append a regex command:

 ... | regex host="somepattern"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Append a regex command:

 ... | regex host="somepattern"

sonicZ
Contributor

well that was easy, Thanks. Forgot about using the regex command directly in search.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...