Splunk Search

select subset of hosts


Hello, splunk newbie here,

I have tens of servers named like abc01, abc02 .... abc20. Now i would like to search for events on a subset of these machines like for example only the abc18 and abc19. I'm trying searches like

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | regex "abc(18|19)"

This seems to work but how can i select data from everything except these "abc(18|19)" ?


doesn't seem to work..

Thanks in advance,


Tags (2)
0 Karma

Revered Legend

you can try using following query

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | search NOT ("abc18" OR "abc19")

Path Finder

I would use the following:

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now NOT host=abc18 NOT host=abc19

There's not a need to run a second search via the | operator, just go ahead and filter out those hosts in the first search command.


Will give it a try, thanks!

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...