Splunk Search

Search command for different PC's

Rhuen
New Member

Hy,

i have create a Dashboard with Error Logs.
1 for all pc's: Computername="*", it works, i see all PC's but which command is the right to see only 2 or 3 PC's with Computername:
Client1 and Client2?!
I was try:
...Computername="Client1,Client"...Computername="Client1" Computername="Client2"...and so on, nothing is working.

I know it works with "Client*" then i see Client1, and Client2, but the Computernames are MAC-Adress...Client1 and Client2 name is only a example.

I hope you know what i mean :-).

This are my complete search string:

source="WMI:WinEventLog:*" ComputerName="*"  | stats count count(eval(Type="Warnung")) as warnings count(eval(Type="Fehler")) as errors by host

greets.

Tags (3)
0 Karma
1 Solution

Ayn
Legend

If you want to search for multiple values of ComputerName you could just OR them together:

ComputerName="Client1" OR ComputerName="Client2" OR ...

View solution in original post

jtrimmi1
Explorer

I think now you can do something like this :

source="WMI:WinEventLog:*" ComputerName IN ("Client1","Client2","Client3","Client4")

Rhuen
New Member

Haha omg you right Ayn 🙂 so simple, thx.

0 Karma

Ayn
Legend

If you want to search for multiple values of ComputerName you could just OR them together:

ComputerName="Client1" OR ComputerName="Client2" OR ...
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...