Splunk Search

Search for multiple hosts in parameterized search

petermuller
Explorer

I have a saved search that will take a 'host' parameter, like the following:

|savedsearch "searchName" host="hostName"

This works when I only want to search for one host, but I'm running into an issue where if I want to specify multiple hosts, this format will not work. I cannot do something like the following because it will only take the last available valid host (hostName2 is the one that shows up in the search results.):
|savedsearch "searchName" host="hostName1" OR host="hostName2"

I know that is is possible to use a wildcard (host="hostName*" will return all hosts in this format), but I only want the two specific hosts.

Do you have any suggestions on how to include two different specific hosts in this situation?

This is with Splunk version 5.0.4

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Define your saved search like this:

index=_internal $host$

and call it like this:

| savedsearch host_search host="host=foo OR host=bar"

That'll run a search like this behind the scenes:

index=_internal host=foo OR host=bar 

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Define your saved search like this:

index=_internal $host$

and call it like this:

| savedsearch host_search host="host=foo OR host=bar"

That'll run a search like this behind the scenes:

index=_internal host=foo OR host=bar 

petermuller
Explorer

That is exactly what I needed. I had it defined as host=$host$ before. This solves it. Thanks!

0 Karma

lguinn2
Legend

What about this one?

| foreach hostName1 hostName2 [  savedsearch "searchName" host="<<FIELD>>" ]

petermuller
Explorer

That may work for the most recent Splunk, but I'm on 5.0.4, which does not have that command yet. I edited the description to add the version number.

0 Karma

lguinn2
Legend

Would this work?

|savedsearch "searchName" host="hostName1"
| append [ savedsearch "searchName" host="hostName2" ]

petermuller
Explorer

When doing that, I get this error:

Error in 'SearchParser': Found circular dependency when expanding savedsearch="searchName"

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...