Splunk Search

spl query output mismatch

vinitpathri
Path Finder

index=_internal host=abc123 source="metrics.log" group=tcpin_connections fwdType=uf
|dedup hostname
|table hostname

i am putting hostname= xyz578(output of above query) in the below query

index=* host=abc123 "xyz578"
but not getting any output

please help me with this missing part.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

index=* does not match index=_internal. You need index=_* to do that. Yeah, I know, not logical.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinitpathri
Path Finder

sorry but i didnt get it 😄

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What did you not get?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinitpathri
Path Finder

index=_* should be a subset of index=*

0 Karma

vinitpathri
Path Finder

asterik is not visible in the comment :-?

index=_(asterik)should be a subset of index=(asterik)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Agreed, but that's not how it works with indexes and Splunk. That's what I meant by "not logical".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...