Splunk Search

metadata search for distributed environment

sanju005ind
Communicator

I have 4 servers in a distributed environment. I use server a to login and do the search.

When I use the search | metadata type=hosts I get all the hosts from all the servers And When I use | metadata type=hosts splunk_server=B I get the hosts from Server B.

But when I use | metadata type=hosts splunk_server!=D I still get all the servers hosts. also it does not allow to have multiple splunk_server in a metadata search. I Also tried | metadata type=hosts NOT splunk_server=D.

Bottonline is I want the metadata hosts only from Server A,B and C and not D.

Tags (1)
0 Karma
1 Solution

Simeon
Splunk Employee
Splunk Employee

Currently, the metadata search does not appear to handle multiple splunk_server values and NOT operators.

View solution in original post

Dan
Splunk Employee
Splunk Employee

Perhaps you can use the join command in conjunction with single splunk_server metadata queries

0 Karma

Simeon
Splunk Employee
Splunk Employee

Currently, the metadata search does not appear to handle multiple splunk_server values and NOT operators.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...