Splunk Search

How can I make this search return results for every host in my environment instead of just one?

chadman
Path Finder

I have a search that looks like:

sourcetype=ejsysinfo_sort host="ws1"| head 1 | rename HD as "Total Disk GB" |table host,"Total Disk GB" |join  [ search sourcetype=ejlog_sort host="ws1"| head 1  | rename Available_D as "Available Disk GB"| table host,"Available Disk GB"]

This works great, but I'm not sure how to make this work to show the same information with all hosts. If I change the host from ws1 to * it only shows the last line from that sourcetype.

Tags (2)
0 Karma
1 Solution

NOUMSSI
Builder

If you maintain to use this query:

sourcetype=ejsysinfo_sort host= | dedup host | rename HD as "Total Disk GB" |table host,"Total Disk GB" |join [ search sourcetype=ejlog_sort host= |dedup host | rename Available_D as "Available Disk GB"| table host,"Available Disk GB",Date] |sort "Available Disk GB" a |table host,"Total Disk GB","Available Disk GB",Date

You must know that it can't much faster and be able to quickly grab, parse, and sort as you think because only your subsearch 2093179 results, truncating to maxout 50000". So despite the fact that the final result gave only last event for each host, the query covers all events and then retains the last event for each host.

View solution in original post

Runals
Motivator

I'd try something like

sourcetype=ejsysinfo_sort OR sourcetype=ejlog_sort | dedup host sourcetype | table host HD Available_D | rename ...
0 Karma

NOUMSSI
Builder

If you maintain to use this query:

sourcetype=ejsysinfo_sort host= | dedup host | rename HD as "Total Disk GB" |table host,"Total Disk GB" |join [ search sourcetype=ejlog_sort host= |dedup host | rename Available_D as "Available Disk GB"| table host,"Available Disk GB",Date] |sort "Available Disk GB" a |table host,"Total Disk GB","Available Disk GB",Date

You must know that it can't much faster and be able to quickly grab, parse, and sort as you think because only your subsearch 2093179 results, truncating to maxout 50000". So despite the fact that the final result gave only last event for each host, the query covers all events and then retains the last event for each host.

NOUMSSI
Builder

Hi, try this

sourcetype=ejsysinfo_sort host=* | rename HD as "Total Disk GB" |table host,"Total Disk GB" |join [ search sourcetype=ejlog_sort host=* | rename Available_D as "Available Disk GB"| table host,"Available Disk GB"]

so just replace host="ws1" by host=* and remove | head 1

0 Karma

chadman
Path Finder

I just tried that and it looks like it's only geting the last event for that sourcetype which will only contain one host. I need it to grab the last event for each host.

0 Karma

NOUMSSI
Builder

Use this:

sourcetype=ejsysinfo_sort  OR sourcetype=ejlog_sort host= | dedup host | rename HD as "Total Disk GB" | rename Available_D as "Available Disk GB"|sort "Available Disk GB" |table host,"Total Disk GB","Available Disk GB",Date
0 Karma

chadman
Path Finder

Thanks, I just tried that and it's not producing what I expected. I was using the head 1 command to grab the last event from the log file for that host. Each host writes some performace data evey min in a csv file. This command seems to grab every event for each host.

0 Karma

NOUMSSI
Builder

what're you expected to see?

0 Karma

chadman
Path Finder

So I currently have about 80 hosts. I would expect to see the table filled with only the last event line for each host. So I would like to see 80 lines that only contain the most recent update. This search seems to look at every event line for every host. I can see hosts with the same name in the table. I also get this message from the search " [subsearch]: Subsearch produced 2093179 results, truncating to maxout 50000"

0 Karma

NOUMSSI
Builder

Ok try this:

sourcetype=ejsysinfo_sort host=*| head 1 | rename HD as "Total Disk GB"|dedup  host,"Total Disk GB" |table host,"Total Disk GB" |join [ search sourcetype=ejlog_sort host=*| head 1 | rename Available_D as "Available Disk GB"| |dedup  host,"Available Disk GB"|table host,"Available Disk GB"]
0 Karma

chadman
Path Finder

If I remove the "head 1" it works.

sourcetype=ejsysinfo_sort host=* | dedup host | rename HD as "Total Disk GB" |table host,"Total Disk GB" |join [ search sourcetype=ejlog_sort host=* |dedup host | rename Available_D as "Available Disk GB"| table host,"Available Disk GB",Date] |sort "Available Disk GB" a |table host,"Total Disk GB","Available Disk GB",Date

This command works, but takes about 1 min to run. I was hopping that it would run much faster and be able to quickly grab, parse, and sort the last line from each event fast since it should be under 80 lines.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...