Splunk Search

How to create a search to find the matching host in a index from the list of hosts ?

Woodpecker
Path Finder

Hi,

I have a list of hosts/devices say from HostA to HostZ (PS: its not  a lookup file) I want to find out which host among the list show up in the particular index, say Index=IndexA.

Could someone help me on this?

Labels (1)
0 Karma

PavelP
Motivator

if you can define hosts using a wildcard (as in your example hostA to hostZ):

 

| metasearch index=IndexA host=host* | stats values(host) AS host 

if host* is to broad then you can restrict it with | where host IN or similar

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Woodpecker,

putting the list of hosts in a lookup is the easiest way to solve your problem.

If you haven't a lookup and this list isn't so log, you could une the IN operator, something like this:

 

index=indexA host IN (hostA, hostB, hostC ...,hostZ
| ...

 

 even if the lookup is the best solution!

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the list of hosts is not a lookup file then in what form is it?  That will make a difference in the search.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...