Filter host based on patterns

[richaGindodia]

Hello All,

I have 100 hosts with two patterns client1, client2, client3..... and server1, server2, server3....
I want to list these host in two different dropdowns

Dropdown1 contains clients
Dropdown2 contains servers

How do I do it.
Please help.

[jmallorquin]

Hi

It could be usefull if you create before a lookup file to create the list and save theses searches to run every night.

index=xxx host=cliente* |table host |outputlookup clients.csv <- ALL TIME
index=xxx host=server* |table host | outputlookup servers.csv <- ALL TIME

[rsennett_splunk · Accepted solution]

You would do something like this

<form>
  <label>New_dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="clients">
       <label>dropdown1(clients)</label>
      <search>
        <query>index=whatever host=client*|stats count by host</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <prefix>host="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="servers">
       <label>dropdown1(clients)</label>
      <search>
        <query>index=whatever host=server*|stats count by host</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <prefix>host="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
   <!-- The Rest of your Dashboard goes here -->
</form>

This will produce two tokens, the value of which would be "host=clientxxx" or "host=serverxxx"

[richaGindodia]

Thanks alot rsennett. This worked.