Splunk Search

Why does "search host!=ComputerName" return all results?

Explorer

I'm looking for Splunk Universal Forwarders that have a different name registered other than the actual host name. This usually happens when a server is renamed. When I execute the search below, I get back the same # of events as if I don't do the comparison. An export of the data to Excel with a simple comparison formula shows that out of the 2619 events returned there are actually 15 servers with old host names.

Why doesn't the search return 15 events?

index=machine sourcetype=WinHostMon source=os host=* ComputerName=* | search host!=ComputerName | table host ComputerName
Tags (3)
0 Karma
1 Solution

Influencer

Just like how in your base search sourcetype=WinHostMon is looking for the sourcetype field to match the string WinHostMon and not a field named WinHostMon, so your search is doing the same looking any host that is not the string ComputerName

What you want instead is the where command which allows for more precision, and even lets you use useful functions in comparisons!

index=machine sourcetype=WinHostMon source=os host= ComputerName= | where host!=ComputerName | table host ComputerName

View solution in original post

Influencer

Just like how in your base search sourcetype=WinHostMon is looking for the sourcetype field to match the string WinHostMon and not a field named WinHostMon, so your search is doing the same looking any host that is not the string ComputerName

What you want instead is the where command which allows for more precision, and even lets you use useful functions in comparisons!

index=machine sourcetype=WinHostMon source=os host= ComputerName= | where host!=ComputerName | table host ComputerName

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!