Hi:
We have a bunch of searches that are being run against a specific set of hosts (we'll say:
TV-host1, TV-host2, TD-host1, TD-host2
i want a way to run a set of saved searches against a list of hosts specified in another saved search.
I currently am doing this in the following method:
savedsearch1:
host="T*-host*"
saved searches that use this:
| savedsearch1 | rest of query
I realize that this is extremely inefficient because it pulls all the logs for those hosts, then narrows down the results from there.
Is there a way to take the actual search syntax from a saved search and apply it to another search inline?
The reason I'm asking this is because I want some saved searches set so that it queries against specific hosts, and if we have a new naming standard, then all I need to do is modify the search that handles the hostnames, rather than modifying 25 other searches and modifying the host syntax on those.
Another question I have, is there a way to narrow down hostname based on a regex, rather than the any character *?
Such as T*-host[0-9]*
So that would find TV-host1, but not TV-hoster2?
We have a couple of hosts that are named similar, and it is confusing some of the saved searches we have.
Thanks for any assistance you could provide
-Jeff
You are looking for mac - wait for it - ros! Macros!
You can define them in either macros.conf or via the UI.
Put your host list (as a search string) in the macro (we'll call it tv_host_list
).
host=TV-host1 OR host=TV-host2 OR ......
Then reference the macro in any other search.
earliest=-1d@d `tv_host_list` | do other things here.
And here's a doc for you: http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/UseSearchMacros
Find us on IRC! Efnet channel #splunk! Live help (and maybe some trout slapping!)! not officially official help - customers and such
You are looking for mac - wait for it - ros! Macros!
You can define them in either macros.conf or via the UI.
Put your host list (as a search string) in the macro (we'll call it tv_host_list
).
host=TV-host1 OR host=TV-host2 OR ......
Then reference the macro in any other search.
earliest=-1d@d `tv_host_list` | do other things here.
And here's a doc for you: http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/UseSearchMacros
Find us on IRC! Efnet channel #splunk! Live help (and maybe some trout slapping!)! not officially official help - customers and such
That is exactly what I am looking for.
Thank you!