Splunk Search

spl query output mismatch

vinitpathri
Path Finder

index=_internal host=abc123 source="metrics.log" group=tcpin_connections fwdType=uf
|dedup hostname
|table hostname

i am putting hostname= xyz578(output of above query) in the below query

index=* host=abc123 "xyz578"
but not getting any output

please help me with this missing part.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

index=* does not match index=_internal. You need index=_* to do that. Yeah, I know, not logical.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinitpathri
Path Finder

sorry but i didnt get it 😄

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What did you not get?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinitpathri
Path Finder

index=_* should be a subset of index=*

0 Karma

vinitpathri
Path Finder

asterik is not visible in the comment :-?

index=_(asterik)should be a subset of index=(asterik)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Agreed, but that's not how it works with indexes and Splunk. That's what I meant by "not logical".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...