Splunk Search
Highlighted

How to list hosts in my index according to host name

Explorer

Greetings!
I'm trying to list part of the hosts in my index but only those that starts off with certain letters (and then a wildcard).
My company has over 10.000 hosts and while not all of them are in my index, I do have over 650 hosts there.
So, what I am trying to do is to have Splunk list all the servers that by platform commonality start off with the letters ucm-.
Another search would ask for Splunk to list all the hosts in my index starting off with the letters mse- since this is a different platform.

I've tried the following:
| metadata type=hosts index=ucv | sort host

I've also tried other variations including:
| metadata type=hosts index=ucv host=ucm | sort host

Splunk however, just lists ALL the hosts in my index instead of the subset of hosts that I'm interested in.
Isn't there some smart way to have a subset of hosts listed and perhaps portrayed in a table with more than only the top ten hosts as in ALL the hosts that starts off with as in either ucm-* or mse-* ?

Thanks!

Tags (1)
Highlighted

Re: How to list hosts in my index according to host name

SplunkTrust
SplunkTrust

Run this over all time:

| tstats count where index=ucv host=ucm* by host

Your approach would also work if you filtered instead of sorted:

| metadata type=hosts index=ucv | search host=ucm*

View solution in original post

Highlighted

Re: How to list hosts in my index according to host name

Explorer

Fantastic, Martin!
Thank you so much!

0 Karma