Splunk Search
Highlighted

Specify More Than One Host?

New Member

Hey everyone! I have a pretty simple question. Below is a sample search string:

index=os sourcetype=df mount="/etc" host=server1

Is there a way to specific more than one host? I thought I could get away with host=server1,server2 but it didn't work out. I'm trying to tailer my visualization chart for my clients as much as possible so it would help out to just display the data that actually matters to them.

0 Karma
Highlighted

Re: Specify More Than One Host?

Builder

Depends on how many hosts you want to specify. If it's two or three, simply using OR will do it:

index=os sourcetype=df mount="/etc" (host=server1 OR host=server2 OR host=server3)

If you get into too many hosts, then you may be able to sue a wildcard if they have similar names. If not, then you may have to use more esoteric means, like a lookup table.

Re: Specify More Than One Host?

Motivator

you can do like below,

index=os sourcetype=df mount="/etc" host IN (server1,server2)

Highlighted

Re: Specify More Than One Host?

New Member

so I am doing sourcetype cisco:asa and host=* but I am not getting all the hosts. Also how do I just get a report on hosts without all the log info?

0 Karma