Splunk Search

Query against a list of computers

raidercom
Communicator

Hi:
We have a bunch of searches that are being run against a specific set of hosts (we'll say:

TV-host1, TV-host2, TD-host1, TD-host2

i want a way to run a set of saved searches against a list of hosts specified in another saved search.

I currently am doing this in the following method:

savedsearch1:
host="T*-host*"

saved searches that use this:
| savedsearch1 | rest of query

I realize that this is extremely inefficient because it pulls all the logs for those hosts, then narrows down the results from there.

Is there a way to take the actual search syntax from a saved search and apply it to another search inline?

The reason I'm asking this is because I want some saved searches set so that it queries against specific hosts, and if we have a new naming standard, then all I need to do is modify the search that handles the hostnames, rather than modifying 25 other searches and modifying the host syntax on those.

Another question I have, is there a way to narrow down hostname based on a regex, rather than the any character *?

Such as T*-host[0-9]*

So that would find TV-host1, but not TV-hoster2?

We have a couple of hosts that are named similar, and it is confusing some of the saved searches we have.

Thanks for any assistance you could provide

-Jeff

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

You are looking for mac - wait for it - ros! Macros!

You can define them in either macros.conf or via the UI.

Put your host list (as a search string) in the macro (we'll call it tv_host_list).

host=TV-host1 OR host=TV-host2 OR ......

Then reference the macro in any other search.

earliest=-1d@d `tv_host_list` | do other things here.

And here's a doc for you: http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/UseSearchMacros

Find us on IRC! Efnet channel #splunk! Live help (and maybe some trout slapping!)! not officially official help - customers and such

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

You are looking for mac - wait for it - ros! Macros!

You can define them in either macros.conf or via the UI.

Put your host list (as a search string) in the macro (we'll call it tv_host_list).

host=TV-host1 OR host=TV-host2 OR ......

Then reference the macro in any other search.

earliest=-1d@d `tv_host_list` | do other things here.

And here's a doc for you: http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/UseSearchMacros

Find us on IRC! Efnet channel #splunk! Live help (and maybe some trout slapping!)! not officially official help - customers and such

raidercom
Communicator

That is exactly what I am looking for.
Thank you!

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...