Splunk Search

Search Help - Add Index to this _internal Search - And combine hosts

aferone
Builder

I would like to add which index each of these hosts comes from in this search.

index=_internal source=*/metrics.log component=Metrics host=*hf* group=tcpin* | top limit=10000 hostname host version os arch

I was trying to append a list of servers from just a normal "index=foo" search, but I couldn't get that working.

hostname                    host                            version os                  arch    count   percent
bar                         barhost1                        5.0.2   Windows x64          556    2.839632
                              barhost2

Sorry for the formatting.

Also, this search shows us which Heavy Forwarders each device is sending logs to. Instead of having a separate line for each Heavy Forwarder a device is sending to, I'd like to combine those values into 1 field per line, as shown above.

Thanks!

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

I use an indexed field called, "splunk_forwarder" to identify my heavy forwarders. Using an indexed field allows me to see which HF sent an event, regardless of which sourcetype I'm looking at. Here's a blog post about it.

View solution in original post

0 Karma

masonmorales
Influencer

I use an indexed field called, "splunk_forwarder" to identify my heavy forwarders. Using an indexed field allows me to see which HF sent an event, regardless of which sourcetype I'm looking at. Here's a blog post about it.

0 Karma

aferone
Builder

But can you see which index that device is associated with?

0 Karma

masonmorales
Influencer

Yes, then you could do something like index=* splunk_forwarder=* | stats values(index) as indexes by splunk_forwarder

0 Karma

aferone
Builder

But are you now searching all raw data that way? Instead of using _internal or summarized data?

0 Karma

masonmorales
Influencer

No, it just adds a new field to all events that get indexed that identifies the sending forwarder.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...