Splunk Search

How to create a search to find the matching host in a index from the list of hosts ?

Woodpecker
Path Finder

Hi,

I have a list of hosts/devices say from HostA to HostZ (PS: its not  a lookup file) I want to find out which host among the list show up in the particular index, say Index=IndexA.

Could someone help me on this?

0 Karma

PavelP
Motivator

if you can define hosts using a wildcard (as in your example hostA to hostZ):

 

| metasearch index=IndexA host=host* | stats values(host) AS host 

if host* is to broad then you can restrict it with | where host IN or similar

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Woodpecker,

putting the list of hosts in a lookup is the easiest way to solve your problem.

If you haven't a lookup and this list isn't so log, you could une the IN operator, something like this:

 

index=indexA host IN (hostA, hostB, hostC ...,hostZ
| ...

 

 even if the lookup is the best solution!

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the list of hosts is not a lookup file then in what form is it?  That will make a difference in the search.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...