Splunk Search

Search query to retrive host upon selection

imthesplunker
Path Finder

Hi,

I have 2 versions with multiple hosts containing dev and stg environment
version1 is 7.2 with host1, host2,... host10(5 dev & 5 stg hosts)
version2 is 8.1 with host1, host2,....host10(3 dev & 7 stg hosts)

I have created dropdown for version(11.2,12.1) and multiselect for enviornment(dev,stg) .
What will be the search query to retrieve host based on selection (for ex :- version1 and stg env )

0 Karma
1 Solution

gokadroid
Motivator

If you are able to search events like index=yourIndex sourcetype=yourScourcetype "11.2" (host=host1 OR host=host2) to return all events of version 11.2 for hosts host1 or host2 then follow the below approach and ensure you have following points covered:

  1. Take a note of the token for your dropdown, I will call it tok_dropdown_version
  2. Take a note of the token for your multiselect, I will call it myToken
  3. Take a note of this answer on multiselect which tells you how to form a query of type (field1=value1 OR field1=value2) which in your case will be host=host1 OR host=host2 and so on (however many values will be selected from multiselect).

With these three as arsenal then your final query shall be like

index=yourIndex sourcetype=yourSourcetype $tok_dropdown_version$ ($myToken$)

View solution in original post

0 Karma

gokadroid
Motivator

If you are able to search events like index=yourIndex sourcetype=yourScourcetype "11.2" (host=host1 OR host=host2) to return all events of version 11.2 for hosts host1 or host2 then follow the below approach and ensure you have following points covered:

  1. Take a note of the token for your dropdown, I will call it tok_dropdown_version
  2. Take a note of the token for your multiselect, I will call it myToken
  3. Take a note of this answer on multiselect which tells you how to form a query of type (field1=value1 OR field1=value2) which in your case will be host=host1 OR host=host2 and so on (however many values will be selected from multiselect).

With these three as arsenal then your final query shall be like

index=yourIndex sourcetype=yourSourcetype $tok_dropdown_version$ ($myToken$)
0 Karma

imthesplunker
Path Finder

This helped me .thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...