Splunk Search

Find hosts matching naming criteria in Splunk?

sm600
Explorer

We use this search quite a bit, and love it. In this example it provides a list of all hosts (servers) reporting to splunk in a specific index...

|metadata type=hosts index=ms_ad_log| convert timeformat=" %m/%d/%Y" ctime(*) none(host) none(type) none(totalCount) |rename firstTime AS first, recentTime AS last, totalCount as total | table host,first,last,total | sort - total

But...I need to narrow this search to a specific set of hosts that are named IAA -- and using this search criteria doesn't seem to work....

|metadata type=hosts index=* host=*IAA*| convert timeformat=" %m/%d/%Y" ctime(*) none(host) none(type) none(totalCount) |rename firstTime AS first, recentTime AS last, totalCount as total | table host,first,last,total | sort - total

Any ideas?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi sm600,

@sk314 got it almost correct 😉 Try this:

| metadata type=hosts index=* 
| search host=IAA*
| convert timeformat=" %m/%d/%Y" ctime(*) none(host) none(type) none(totalCount) 
| rename firstTime AS first, recentTime AS last, totalCount as total 
| table host,first,last,total 
| sort - total

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi sm600,

@sk314 got it almost correct 😉 Try this:

| metadata type=hosts index=* 
| search host=IAA*
| convert timeformat=" %m/%d/%Y" ctime(*) none(host) none(type) none(totalCount) 
| rename firstTime AS first, recentTime AS last, totalCount as total 
| table host,first,last,total 
| sort - total

cheers, MuS

sk314
Builder

Not again! 😐 😛

sm600
Explorer

Thanks...adding

|search host=*iaa*| 

worked perfectly

sk314
Builder

Did you try using host=IAA* ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...