Splunk Search

search query for a series of hosts

ebailey
Communicator

I need to run a query for a number of hosts

i.e. host=app[1-22]* error

using OR between every host is really not workable.

Is this possible with the query language? It does not appear possible to use regex in the query language itself, but I am hoping I am wrong.

Thanks!

Tags (3)

alacercogitatus
SplunkTrust
SplunkTrust

No, regex is not possible at that point of the search. Try this:

host=app* error | rex field=host "app(?<host_number>\d+" | search host_number<23

You can also tag hosts (http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/tagsconf).

[host=app1]
findme = enabled

[host=app2]
findme = enabled

Then search:

host=app* tag::host=findme error

Eldest_Malk
Engager

Looks like you missed the closing parenthesis:

  host=app* error | rex field=host "app(?<host_number>\d+)" | search host_number<23
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...