Splunk Search

Search for host name where hostname is not an IP

hartfoml
Motivator

When I use the | metadata type=hosts I see all my servers as well as network equipment that have host as the IP of the device.

I would like to do the search and leave out all the IPs under host and only get the ones that have alphanumeric hostnames

0 Karma
1 Solution

skawasaki_splun
Splunk Employee
Splunk Employee
| metadata type=hosts | regex host!="^(?:\d{1,3}\.){3}\d{1,3}"

Use regex to find all host that doesn't follow the IPv4 address like 223.34.2.99.

More info about regex: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/regex

View solution in original post

skawasaki_splun
Splunk Employee
Splunk Employee
| metadata type=hosts | regex host!="^(?:\d{1,3}\.){3}\d{1,3}"

Use regex to find all host that doesn't follow the IPv4 address like 223.34.2.99.

More info about regex: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/regex

hartfoml
Motivator

Thanks Much @skawasaki_splunk I gave you 5 points but this was too easy for you. Thanks again for the help.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...