How to create a search to find the matching host in a index from the list of hosts ?

[Woodpecker]

Hi,

I have a list of hosts/devices say from HostA to HostZ (PS: its not  a lookup file) I want to find out which host among the list show up in the particular index, say Index=IndexA.

Could someone help me on this?

[PavelP]

if you can define hosts using a wildcard (as in your example hostA to hostZ):

| metasearch index=IndexA host=host* | stats values(host) AS host 

if host* is to broad then you can restrict it with | where host IN or similar

[gcusello]

Hi @Woodpecker,

putting the list of hosts in a lookup is the easiest way to solve your problem.

If you haven't a lookup and this list isn't so log, you could une the IN operator, something like this:

index=indexA host IN (hostA, hostB, hostC ...,hostZ
| ...

 even if the lookup is the best solution!

Ciao.

Giuseppe

[richgalloway]

If the list of hosts is not a lookup file then in what form is it?  That will make a difference in the search.