Splunk Search

How to write a simple search query to add another set of host name along with the current present host name?

Hemnaath
Motivator

Hi All, I have used the below query to capture the splunk service status (Up or Down) via splunkd.log. This query is working fine, but we have added few more splunk instance to the current environment and we need to capture these splunk service status along with the old splunk instances. My requirement is to include the newly build splunk host details to pull their service status.

Newly build host starts with the letter vms , so how to add this host name along with host name hs

Query details :
index=_internal host=hs* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures

thanks in advance.

Tags (2)
0 Karma
1 Solution

inventsekar
Super Champion

Hi Hemnaath, Please check -

index=_internal host=hs* OR host=vms* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures

>>> Happy Splunking !

View solution in original post

0 Karma

inventsekar
Super Champion

Hi Hemnaath, Please check -

index=_internal host=hs* OR host=vms* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures

>>> Happy Splunking !
0 Karma

pragi_eashwar
Engager

Hi Hemanth

If the query is same just use the OR operator for the host like mentioned below,

index=------ host=hs* OR host=vms* -----query--------

0 Karma

Hemnaath
Motivator

thanks it worked, at same time could please tell me where we need to use OR operator and AND operator appropriately in SPL query. thanks in advance.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>