Splunk Search

How to create a search to find the matching host in a index from the list of hosts ?

Woodpecker
Path Finder

Hi,

I have a list of hosts/devices say from HostA to HostZ (PS: its not  a lookup file) I want to find out which host among the list show up in the particular index, say Index=IndexA.

Could someone help me on this?

0 Karma

PavelP
Motivator

if you can define hosts using a wildcard (as in your example hostA to hostZ):

 

| metasearch index=IndexA host=host* | stats values(host) AS host 

if host* is to broad then you can restrict it with | where host IN or similar

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Woodpecker,

putting the list of hosts in a lookup is the easiest way to solve your problem.

If you haven't a lookup and this list isn't so log, you could une the IN operator, something like this:

 

index=indexA host IN (hostA, hostB, hostC ...,hostZ
| ...

 

 even if the lookup is the best solution!

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the list of hosts is not a lookup file then in what form is it?  That will make a difference in the search.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...