I've been using tstats for most of the use cases that metasearch covers, and so I'm interested in what metasearch can do that tstats can't. From my reading of the documentation, it seems that metasearch...
I can run |metasearch ((index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2)) and it works — no issues.
I can create a macro, say mysrc with definition (index=IN1 sourcetype=S1) OR (index=I...
Hi,
I' cant end my search using metasearch when I need to find in index something with space betwen like "Microsoft Update". There is no problem to find there one word aplikaction like b...
I was wondering whether Splunk supports earliest and latest date in Metadata, metasearch, and tstats command?
I tried to check all the sites but couldn't find it.
How to use multiple metadata O...
I am monitoring a CSV file and creating a dashboard based on it, the file is modified many times a day, or not for many days at all. The file has not just rows added to it but also removed, plus the...
...cannot figure it out. Please help me. This is how far i have come:
| metasearch sourcetype=* host=* | dedup sourcetype, host | "here I would like a tabular output of hosts missing this sourcetype"
I'm looking for a way to find out which splunk_server contains data for my index for older versions of Splunk. tstats doesn't work and metadata is lacking for splunk_server.
Any suggestions?
im trying to set up an alert that will mail me when one of my indexes hasn't passed any data for the last 3 hours, and make it part of a dashboard does anyone have a search string that will do this ...
I'm able to make a metasearch on sources for example, but is it also possible to make one on tags, so I could populate a dropdown with the tags I've defined ?