Splunk Search

select subset of hosts

BertKraan
Engager

Hello, splunk newbie here,

I have tens of servers named like abc01, abc02 .... abc20. Now i would like to search for events on a subset of these machines like for example only the abc18 and abc19. I'm trying searches like

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | regex "abc(18|19)"

This seems to work but how can i select data from everything except these "abc(18|19)" ?

host!="abc(18|19)"

doesn't seem to work..

Thanks in advance,

Bert

Tags (2)
0 Karma

somesoni2
Revered Legend

you can try using following query

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now | search NOT ("abc18" OR "abc19")

zeroactive
Path Finder

I would use the following:

index="prd_access" sourcetype="access:web:foo" earliest=-7d latest=now NOT host=abc18 NOT host=abc19

There's not a need to run a second search via the | operator, just go ahead and filter out those hosts in the first search command.

BertKraan
Engager

Will give it a try, thanks!

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...