Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
2,000 results
Sorted by:
06-15-2020
04:22 AM
...he actual server was i.e. web server, DB server etc.).
So my question is:
- Can the hosts in Splunk be tagged with metadata to describe their function?
Labels
- Labels:
-
universal forwarder
2 weeks ago
Hello, I'm using metadata on hosts to get their first event time etc, are they accurate even on oldest records? | metadata type=hosts By the way where are they stored? Thanks 🙂
02-23-2018
05:00 AM
...earch head, it's all ok, in the second search head the sourcetype oracle lost the metadata host.
This problem has occurred since I updated to version 7.0.2.
10-08-2019
02:17 PM
We've got over 50 sourcetypes, however, when I run the command below, I only see syslog under the sourcetype column.
| metadata type=sourcetypes | sort - totalCount
Does anyone have an explanation?
09-29-2015
08:43 AM
1 Karma
Hi,
I have two indizes: dbtrace and dbmsg. The 1st "dbtrace" has trace recs of bags, the 2nd "dbmsg" stores the error msgs with PRIO flag.
A timechart (one line per index) should count the recs f...
10-15-2015
07:49 AM
...hould I be overriding the host and other metadata? Is it possible to override host and sourcetype for the same log lines?
08-30-2016
07:37 AM
I'm trying to join hosts from a .csv file to the results of this metadata search:
|metadata type=hosts | eval time_diff = now() - lastTime
The .csv file will have some hosts that don't exist i...
05-17-2010
05:47 PM
...elong to their country using roles. I would like each user to see on the default dashboard the hosts which they have access to the last reported date and the tag.
I use the following query "| metadata...
Show results in replies (3)
-
i don't see you using the |tags search command and then filtering based on that. The |metadata...
-
...hat I am using when filtering by tags: | metadata type=hosts | tags host | search NOT tag::host=r...
-
The only way I have been able to filter the events while using | metadata type=host is to add a s...
07-09-2013
08:27 AM
I am trying to create a utility using the metadata command that will allow me to see what sourcetypes exist by index. I have started with a command that returns all the sourcetypes for an index i e...
- Tags:
- metadata
05-29-2014
11:14 AM
When running | metadata index=myindex type=sources , I see 301785788 for my totalCount for one of my sources (let's call it source1 ).
When running index=myindex source=source1 | stats c...
