Splunk Search

metadata search for distributed environment

Communicator

I have 4 servers in a distributed environment. I use server a to login and do the search.

When I use the search | metadata type=hosts I get all the hosts from all the servers And When I use | metadata type=hosts splunk_server=B I get the hosts from Server B.

But when I use | metadata type=hosts splunk_server!=D I still get all the servers hosts. also it does not allow to have multiple splunk_server in a metadata search. I Also tried | metadata type=hosts NOT splunk_server=D.

Bottonline is I want the metadata hosts only from Server A,B and C and not D.

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Currently, the metadata search does not appear to handle multiple splunk_server values and NOT operators.

View solution in original post

Splunk Employee
Splunk Employee

Perhaps you can use the join command in conjunction with single splunk_server metadata queries

0 Karma

Splunk Employee
Splunk Employee

Currently, the metadata search does not appear to handle multiple splunk_server values and NOT operators.

View solution in original post