Splunk Search

Get the Splunk indexer name output.

Communicator

I am using the following query to get the output of all my forwardars/hosts

|metadata type=hosts | eval age = now() - lastTime | search age < 604800 | tags host | search tag::host=FINANCE| fields + host, firstTime, lastTime,totalCount, tag::host| convert ctime(firstTime) | convert ctime(lastTime) | sort - host | rename host as Host,firstTime as "First Reported",lastTime as "Last Reported",totalCount as "Total Events", tag::host as Tags

I would also like another field called splunk_server.However when I use splunk_server as a field I am not getting any output.

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

The metadata command as far as I know has no options to separate results by splunk_server (unlike, e.g., the eventcount command or search commands). There is probably no efficient way to get the information you are asking for short of logging onto each server separately and examining the metadata files in the index directory.

View solution in original post

Splunk Employee
Splunk Employee

The metadata command as far as I know has no options to separate results by splunk_server (unlike, e.g., the eventcount command or search commands). There is probably no efficient way to get the information you are asking for short of logging onto each server separately and examining the metadata files in the index directory.

View solution in original post

Splunk Employee
Splunk Employee

Since that is a metadata search, I'm not sure the splunk_server field can be returned/used in that manner. Similarly, I'm not sure you can return the index field. You can definitely use those two fields as parameters to search on, but I don't think they will be returned in the results.

Communicator

I am doing a distributed search and get these metrics across multiple splunk servers

0 Karma

Super Champion

Are you trying to do a distributed search and get these metrics across multiple splunk servers, or simply do something like | rename host as splunk_server?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!