Create field from small subset of events

[splunklearner12]

I have a field for device types (desktop or mobile) and a field for the hostname. Only a small number of events contain the device type field but all contain the host field. I need to create a field that contains all mobile hosts, but return all events related to them and not just the ones that contain the device type field. I have managed to get a list of all mobile hosts, but I don't know how to put them all into a field that is independent of the existence of the device class field.
To get a list of mobile hosts I use this search: (device_class=mobile | dedup host | stats values(host))

[DavidHourani · Accepted solution]

Hi @splunklearner1234,

This will filter on the hosts that are part of the device_class mobile and return all events :

index=whereYourDataIs [search device_class=mobile |dedup host |return 100 host ]

Let me know if that works out for you.

Cheers,
David

[splunklearner12]

Thanks it works, although it is pretty slow.

[DavidHourani]

Yeah, thats because of the subsearch. If you want to accelerate the results then the best approach would be to store your mobile hosts in a lookup file and use that instead 🙂

[splunklearner12]

Ahh that's it. I've managed to create a lookup which is faster - thanks.