Splunk Search

Best way to get a subset of metadata results

Contributor

I am trying to get a truncated list of metadata, and cant seem to get the search recognized.
How can i filter certain hosts with a regex pattern against the hostfield returned by a simple metadata search?

 |metadata type=hosts index=main

I've tried subsearches, and using various patterns such as this with no luck.

rex field=host "(?P<somehost>somepattern)"

Thanks

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Append a regex command:

 ... | regex host="somepattern"

View solution in original post

SplunkTrust
SplunkTrust

Append a regex command:

 ... | regex host="somepattern"

View solution in original post

Contributor

well that was easy, Thanks. Forgot about using the regex command directly in search.

0 Karma