Splunk Search

help on a filter issue after a loadjob command

jip31
Motivator

hi

I use the search below and I call it from a loadjob command
After the loadjob execution, I need to filter the data by host but it doesnt works
I had | table host after | stats dc(host) but nothing happends
what is the problem please??

  `AppliService`  Name="wuauserv" 
    | fields Name, host 
    | stats dc(host)


    | loadjob savedsearch="admin:TEST_sh:FO_EventServiceLog_Serv_1" 
    | search host=$tok_filterhost$
Tags (1)
0 Karma

woodcock
Esteemed Legend

Add AS host to the first search, like this:

`AppliService` Name="wuauserv" 
| stats dc(host) AS host
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

Your first search is not returning host field. So the filter might not work for you.

You can try this instead.

First search

`AppliService`  Name="wuauserv" 
| fields Name, host 

Second Search

  | loadjob savedsearch="admin:TEST_sh:FO_EventServiceLog_Serv_1" 
 | search host=$tok_filterhost$
 | stats dc(host)
0 Karma

jip31
Motivator

thanks to you, I test in a few days and keep you aware

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31
Did you get a chance to test this?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...