Splunk Search

search query for a series of hosts


I need to run a query for a number of hosts

i.e. host=app[1-22]* error

using OR between every host is really not workable.

Is this possible with the query language? It does not appear possible to use regex in the query language itself, but I am hoping I am wrong.


Tags (3)


No, regex is not possible at that point of the search. Try this:

host=app* error | rex field=host "app(?<host_number>\d+" | search host_number<23

You can also tag hosts (http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/tagsconf).

findme = enabled

findme = enabled

Then search:

host=app* tag::host=findme error


Looks like you missed the closing parenthesis:

  host=app* error | rex field=host "app(?<host_number>\d+)" | search host_number<23
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...