Splunk Search

How to list hosts in my index according to host name

bearman
Explorer

Greetings!
I'm trying to list part of the hosts in my index but only those that starts off with certain letters (and then a wildcard).
My company has over 10.000 hosts and while not all of them are in my index, I do have over 650 hosts there.
So, what I am trying to do is to have Splunk list all the servers that by platform commonality start off with the letters ucm-.
Another search would ask for Splunk to list all the hosts in my index starting off with the letters mse- since this is a different platform.

I've tried the following:
| metadata type=hosts index=ucv | sort host

I've also tried other variations including:
| metadata type=hosts index=ucv host=ucm | sort host

Splunk however, just lists ALL the hosts in my index instead of the subset of hosts that I'm interested in.
Isn't there some smart way to have a subset of hosts listed and perhaps portrayed in a table with more than only the top ten hosts as in ALL the hosts that starts off with as in either ucm-* or mse-* ?

Thanks!

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Run this over all time:

| tstats count where index=ucv host=ucm* by host

Your approach would also work if you filtered instead of sorted:

| metadata type=hosts index=ucv | search host=ucm*

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Run this over all time:

| tstats count where index=ucv host=ucm* by host

Your approach would also work if you filtered instead of sorted:

| metadata type=hosts index=ucv | search host=ucm*

bearman
Explorer

Fantastic, Martin!
Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...