Splunk Search

multiple host input listing in splunk query (search & Reporting)

p544gm
Explorer

i am seeking a way to define a variable where i can define a static list of hosts to (re-)use in adhoc searches

Example instead of doing this everytime

          index=os host=hosta OR host=hostb OR host=hostc ....host=hostnn

Instead do something like this 

          index=os host=$MY_HOSTLIST_VAR

I've been trying to do something with Lookup csv file which I uploaded, but can't seem to get that syntax correct.

Labels (1)
0 Karma
1 Solution

impurush
Contributor

You can create an eventtype with all the hosts you want in the queries and use the eventtype in your query.

Example:

Create a eventtype=host_list
host=hosta OR host=hostb OR host=hostc

Then use in your query
index=os eventtype=host_list

View solution in original post

Tags (1)

p544gm
Explorer

Thanks worked!

0 Karma

impurush
Contributor

You can create an eventtype with all the hosts you want in the queries and use the eventtype in your query.

Example:

Create a eventtype=host_list
host=hosta OR host=hostb OR host=hostc

Then use in your query
index=os eventtype=host_list

Tags (1)
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...