Splunk Search

How to edit this search to exclude some servers from the metadata?

New Member
| metadata   index=Test_app  type=hosts | eval age = now()-lastTime | where age > (60) | sort age d | convert ctime(lastTime)  | fields age,host,lastTime

Please provide query for excluding a few servers from this metadata.

0 Karma

Splunk Employee
Splunk Employee

What do you mean by servers? The splunk indexers that are returning the data or the actual host names returned by the metadata?

If you want to filter by hosts, I like to use a regex statement since often host names have some pattern that can be used (i.e. wxxx for windows, xxxpxxx - production, etc.) This is easy with regex:

| regex host!="^w"
or
| regex host!="np|dev"

Just remember that regex is case sensitive, so you may need to use "(?i)np|dev" to make it case insensitive.

0 Karma

SplunkTrust
SplunkTrust

You can filter using search command. Ideally you should include the hosts you need rather than excluding the hosts you don't need. You can use AND and OR for adding a list of hosts. Following example will exclude all servers starting with abc like abc01, abc02 etc.

| metadata index=Test_app type=hosts 
| search host!="abc*"
| eval age = now()-lastTime 
| where age > (60) 
| sort age d 
| convert ctime(lastTime)
| fields age,host,lastTime

Following will not include servers abc, def, ghi. Like stated earlier, performance wise, it is better to include required fields values rather than excluding the values not required.

| metadata <Your Base Search>
| search host!="abc" AND host!="def" AND host!="ghi"
| <your remaining search>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"