Search Help - Add Index to this _internal Search - And combine hosts

[aferone]

I would like to add which index each of these hosts comes from in this search.

index=_internal source=*/metrics.log component=Metrics host=*hf* group=tcpin* | top limit=10000 hostname host version os arch

I was trying to append a list of servers from just a normal "index=foo" search, but I couldn't get that working.

hostname                    host                            version os                  arch    count   percent
bar                         barhost1                        5.0.2   Windows x64          556    2.839632
                              barhost2

Sorry for the formatting.

Also, this search shows us which Heavy Forwarders each device is sending logs to. Instead of having a separate line for each Heavy Forwarder a device is sending to, I'd like to combine those values into 1 field per line, as shown above.

Thanks!

[masonmorales · Accepted solution]

I use an indexed field called, "splunk_forwarder" to identify my heavy forwarders. Using an indexed field allows me to see which HF sent an event, regardless of which sourcetype I'm looking at. Here's a blog post about it.

[aferone]

But can you see which index that device is associated with?

[masonmorales]

Yes, then you could do something like index=* splunk_forwarder=* | stats values(index) as indexes by splunk_forwarder

[aferone]

But are you now searching all raw data that way? Instead of using _internal or summarized data?

[masonmorales]

No, it just adds a new field to all events that get indexed that identifies the sending forwarder.