We are frequently required to validate that data is being received by Splunk from multiple servers. The lists of IPs/hosts can be quite long. I am trying to come up with a search that will make this easier, like putting the entries into lookup files and then running a search against the entries in the lookups. So far, I have a lookup with a hostname, IP, and potentially, a wildcard for that host (sometimes the hosts are fully qualified and sometimes they are not). The IPs are reported as hosts, not as a separate "ip" field.
By using this search, I can retrieve data for hosts:
index=* [|inputlookup testSVB2.csv|table host ]
Is there anyway to expand this so it it will run a search against matching hosts OR IPs OR wildcards? When I table out host or IP, it seems to be running an "AND", rather than an "OR".
Finally, is there anyway to limit the number of events returned per host?
You can achieve that using map command
|inputlookup estSVB2.csv|fields host ip| map search="index=* host=$host$ OR ip=$ip$| table host ip"
You need the
format command; here is a run-anywhere example:
|makeresults | eval raw="host1,ip1 host2,ip2 host3,ip3" | makemv raw | mvexpand raw | rename raw AS _raw | rex "^(?<host>\w+),(?<ip>\w+)$" | table host ip | format "(" "(" "OR" ")" "OR" ")"
In your case, like this:
index=* [|inputlookup testSVB2.csv | table host ip | format "(" "(" "OR" ")" "OR" ")"]
To limit the number of events per host just do this (I have chosen to limit to 10):
index=* [|inputlookup testSVB2.csv | table host ip | format "(" "(" "OR" ")" "OR" ")"] | dedup 10 host
Thanks. These are both very good, it looks like woodcock's is more what I'm looking to implement. Is there anyway to limit the results per host? I tried "top limit=x", but that didn't work.
Figured it out. Add a "top limit=x host" to the end.
Also came up with a way to do the same thing via tstats, which is much faster.
"We are frequently required to validate that data is being received by Splunk from multiple servers."
What about the Monitoring Console's page for Forwarders?
I use the alerts in MC as well to let me know of missing forwarders