Splunk Search

spl query output mismatch

vinitpathri
Path Finder

index=_internal host=abc123 source="metrics.log" group=tcpin_connections fwdType=uf
|dedup hostname
|table hostname

i am putting hostname= xyz578(output of above query) in the below query

index=* host=abc123 "xyz578"
but not getting any output

please help me with this missing part.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

index=* does not match index=_internal. You need index=_* to do that. Yeah, I know, not logical.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinitpathri
Path Finder

sorry but i didnt get it 😄

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What did you not get?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinitpathri
Path Finder

index=_* should be a subset of index=*

0 Karma

vinitpathri
Path Finder

asterik is not visible in the comment :-?

index=_(asterik)should be a subset of index=(asterik)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Agreed, but that's not how it works with indexes and Splunk. That's what I meant by "not logical".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...