Splunk Search

Search Query Assistance - break data into table.

herndona
Engager

I am working on a search that will take a massive list of user groups and table the servers under such group.
An example input:

Group:  appldev ===> uslx233, uslx235, uslx238, uslx239, xls001cn03, xls001cn04
Group:  appldvs ===> xla001cn01, xla001cn02, xla001cn07, xls001cn01, xls001cn02, xls001cn03, xls001cn04
Group:  cmod ===> uslx30a, uslx31a, uslx32a, uslx33a, uslx34a, uslx1064, uslx1065, uslx1067

In the example, appldev is the group name and everything else after ===> are the servers it pertains to. This all comes in as a single Splunk log entry (it is about 58 lines long).
I will be writing an XML based form in Splunk using the group names as radio buttons. When a group name is selected, it will bring up a table of all servers. I can get the radio button and dynamic dashboard into place, however, I am looking for suggestions on breaking out just the servers requested by the radio button.

For example, if you ignore the radio button scenario above, how would I get a search to do the following:

pseudo search:

group='appldev' | table related_hosts

output:

related_hosts:

uslx233
uslx235
uslx238
...
...
..

Any suggestions are appreciated.
Thanks!

0 Karma

sideview
SplunkTrust
SplunkTrust

if the field really is called "related_hosts", then it would look like

group='appldev' | stats count by related_hosts

If the field is simply "host", then

group='appldev' | stats count by host

and if you want to sort by count,

    group='appldev' | stats count by host | sort 0 - count
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...