Splunk Search

metadata search for distributed environment

sanju005ind
Communicator

I have 4 servers in a distributed environment. I use server a to login and do the search.

When I use the search | metadata type=hosts I get all the hosts from all the servers And When I use | metadata type=hosts splunk_server=B I get the hosts from Server B.

But when I use | metadata type=hosts splunk_server!=D I still get all the servers hosts. also it does not allow to have multiple splunk_server in a metadata search. I Also tried | metadata type=hosts NOT splunk_server=D.

Bottonline is I want the metadata hosts only from Server A,B and C and not D.

Tags (1)
0 Karma
1 Solution

Simeon
Splunk Employee
Splunk Employee

Currently, the metadata search does not appear to handle multiple splunk_server values and NOT operators.

View solution in original post

Dan
Splunk Employee
Splunk Employee

Perhaps you can use the join command in conjunction with single splunk_server metadata queries

0 Karma

Simeon
Splunk Employee
Splunk Employee

Currently, the metadata search does not appear to handle multiple splunk_server values and NOT operators.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!