Splunk Search

How to create a search to find the matching host in a index from the list of hosts ?

Woodpecker
Path Finder

Hi,

I have a list of hosts/devices say from HostA to HostZ (PS: its not  a lookup file) I want to find out which host among the list show up in the particular index, say Index=IndexA.

Could someone help me on this?

Labels (1)
0 Karma

PavelP
Motivator

if you can define hosts using a wildcard (as in your example hostA to hostZ):

 

| metasearch index=IndexA host=host* | stats values(host) AS host 

if host* is to broad then you can restrict it with | where host IN or similar

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Woodpecker,

putting the list of hosts in a lookup is the easiest way to solve your problem.

If you haven't a lookup and this list isn't so log, you could une the IN operator, something like this:

 

index=indexA host IN (hostA, hostB, hostC ...,hostZ
| ...

 

 even if the lookup is the best solution!

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the list of hosts is not a lookup file then in what form is it?  That will make a difference in the search.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...