I am using the following query to get the output of all my forwardars/hosts
|metadata type=hosts | eval age = now() - lastTime | search age < 604800 | tags host | search tag::host=FINANCE| fields + host, firstTime, lastTime,totalCount, tag::host| convert ctime(firstTime) | convert ctime(lastTime) | sort - host | rename host as Host,firstTime as "First Reported",lastTime as "Last Reported",totalCount as "Total Events", tag::host as Tags
I would also like another field called splunk_server.However when I use splunk_server as a field I am not getting any output.
Are you trying to do a distributed search and get these metrics across multiple splunk servers, or simply do something like
| rename host as splunk_server?
Since that is a metadata search, I'm not sure the splunk_server field can be returned/used in that manner. Similarly, I'm not sure you can return the index field. You can definitely use those two fields as parameters to search on, but I don't think they will be returned in the results.
metadata command as far as I know has no options to separate results by
splunk_server (unlike, e.g., the
eventcount command or search commands). There is probably no efficient way to get the information you are asking for short of logging onto each server separately and examining the metadata files in the index directory.