Search for multiple hosts in parameterized search

[petermuller]

I have a saved search that will take a 'host' parameter, like the following:

|savedsearch "searchName" host="hostName"

This works when I only want to search for one host, but I'm running into an issue where if I want to specify multiple hosts, this format will not work. I cannot do something like the following because it will only take the last available valid host (hostName2 is the one that shows up in the search results.):

|savedsearch "searchName" host="hostName1" OR host="hostName2"

I know that is is possible to use a wildcard (host="hostName*" will return all hosts in this format), but I only want the two specific hosts.

Do you have any suggestions on how to include two different specific hosts in this situation?

This is with Splunk version 5.0.4

[martin_mueller · Accepted solution]

Define your saved search like this:

index=_internal $host$

and call it like this:

| savedsearch host_search host="host=foo OR host=bar"

That'll run a search like this behind the scenes:

index=_internal host=foo OR host=bar 

[petermuller]

That is exactly what I needed. I had it defined as host=$host$ before. This solves it. Thanks!

[lguinn2]

What about this one?

| foreach hostName1 hostName2 [  savedsearch "searchName" host="<<FIELD>>" ]

[petermuller]

That may work for the most recent Splunk, but I'm on 5.0.4, which does not have that command yet. I edited the description to add the version number.

[lguinn2]

Would this work?

|savedsearch "searchName" host="hostName1"
| append [ savedsearch "searchName" host="hostName2" ]

[petermuller]

When doing that, I get this error:

Error in 'SearchParser': Found circular dependency when expanding savedsearch="searchName"