Splunk Search

Create field from small subset of events

splunklearner12
Path Finder

I have a field for device types (desktop or mobile) and a field for the hostname. Only a small number of events contain the device type field but all contain the host field. I need to create a field that contains all mobile hosts, but return all events related to them and not just the ones that contain the device type field. I have managed to get a list of all mobile hosts, but I don't know how to put them all into a field that is independent of the existence of the device class field.
To get a list of mobile hosts I use this search: (device_class=mobile | dedup host | stats values(host))

Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @splunklearner1234,

This will filter on the hosts that are part of the device_class mobile and return all events :

index=whereYourDataIs [search device_class=mobile |dedup host |return 100 host ]

Let me know if that works out for you.

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @splunklearner1234,

This will filter on the hosts that are part of the device_class mobile and return all events :

index=whereYourDataIs [search device_class=mobile |dedup host |return 100 host ]

Let me know if that works out for you.

Cheers,
David

splunklearner12
Path Finder

Thanks it works, although it is pretty slow.

0 Karma

DavidHourani
Super Champion

Yeah, thats because of the subsearch. If you want to accelerate the results then the best approach would be to store your mobile hosts in a lookup file and use that instead 🙂

0 Karma

splunklearner12
Path Finder

Ahh that's it. I've managed to create a lookup which is faster - thanks.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...