Splunk Search

Host field without wildcards returns no results

cdoebert
Path Finder

If I run a search that says * host=*somehost*, I get results back. If I remove the wildcards around the host field and only run index=blah host=somehost, then nothing is returned.

The host field is just "somehost" (without quotes). If I go to the selected fields sidebar and select "somehost" out of the values of host, it generates the search * host=*somehost* host="somehost" and returns no results. Same if I select the "somehost" value out of an event returned from the wildcard search and generate a new search from that.

What would cause Splunk to require that there are wildcards around this hostname?

0 Karma

hok2010
New Member

it seems like your host is not in the blah index,

make sure the host resides in right index

try search:
index=* host=somehost

0 Karma

cdoebert
Path Finder

That returns no results.

Any search where the host field for this particular host does not have wildcards around it returns no results.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...