Query against a list of computers

[raidercom]

Hi:
We have a bunch of searches that are being run against a specific set of hosts (we'll say:

TV-host1, TV-host2, TD-host1, TD-host2

i want a way to run a set of saved searches against a list of hosts specified in another saved search.

I currently am doing this in the following method:

savedsearch1:
host="T*-host*"

saved searches that use this:
| savedsearch1 | rest of query

I realize that this is extremely inefficient because it pulls all the logs for those hosts, then narrows down the results from there.

Is there a way to take the actual search syntax from a saved search and apply it to another search inline?

The reason I'm asking this is because I want some saved searches set so that it queries against specific hosts, and if we have a new naming standard, then all I need to do is modify the search that handles the hostnames, rather than modifying 25 other searches and modifying the host syntax on those.

Another question I have, is there a way to narrow down hostname based on a regex, rather than the any character *?

Such as T*-host[0-9]*

So that would find TV-host1, but not TV-hoster2?

We have a couple of hosts that are named similar, and it is confusing some of the saved searches we have.

Thanks for any assistance you could provide

-Jeff

[alacercogitatus · Accepted solution]

You are looking for mac - wait for it - ros! Macros!

You can define them in either macros.conf or via the UI.

Put your host list (as a search string) in the macro (we'll call it tv_host_list).

host=TV-host1 OR host=TV-host2 OR ......

Then reference the macro in any other search.

earliest=-1d@d `tv_host_list` | do other things here.

And here's a doc for you: http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/UseSearchMacros

Find us on IRC! Efnet channel #splunk! Live help (and maybe some trout slapping!)! not officially official help - customers and such

[raidercom]

That is exactly what I am looking for.
Thank you!