Splunk Search

Specify More Than One Host?

New Member

Hey everyone! I have a pretty simple question. Below is a sample search string:

index=os sourcetype=df mount="/etc" host=server1

Is there a way to specific more than one host? I thought I could get away with host=server1,server2 but it didn't work out. I'm trying to tailer my visualization chart for my clients as much as possible so it would help out to just display the data that actually matters to them.

0 Karma

New Member

so I am doing sourcetype cisco:asa and host=* but I am not getting all the hosts. Also how do I just get a report on hosts without all the log info?

0 Karma

Super Champion

you can do like below,

index=os sourcetype=df mount="/etc" host IN (server1,server2)

If this helps, give a like below.


Depends on how many hosts you want to specify. If it's two or three, simply using OR will do it:

index=os sourcetype=df mount="/etc" (host=server1 OR host=server2 OR host=server3)

If you get into too many hosts, then you may be able to sue a wildcard if they have similar names. If not, then you may have to use more esoteric means, like a lookup table.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!