Getting Data In

How to create this search?

NanSplk01
Path Finder

I need to create a search (or an embedded search that feeds data to another search.  What I'm trying to get is a search like  |tstats values(host) where index=* by index which might feed to a spread sheet that has server and host and then another search on top of it to match up host with index. (NOT indexers)

|tstats values(host) where index=* by index
Labels (2)
0 Karma
1 Solution

NanSplk01
Path Finder

Thank you, used part of this with a search, but had to get some assistance.  The final search looked a little like this--did not use two searches, just one:

index=_internal source=*metrics.log group=tcpin_connections
| eval sourceHost=lower(if(isnull(hostname), sourceHost,hostname))
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| join sourceHost
[|tstats values(host) where index=* NOT index=*** NOT index=***| rename values(host) as host
| mvexpand host
| dedup host index
| eval sourceHost= lower(host)
| fields - host]
| dedup sourceHost connectType version
| table sourceHost connectType version
| sort index

 

Hopes this helps anyone else who needs to combine information from two searches.

View solution in original post

0 Karma

nyc_jason
Splunk Employee
Splunk Employee

Hello, so are you looking to output a table of host and index to show what hosts are in each index? If so, try this: |tstats count where index=* by host index|fields - count

0 Karma

NanSplk01
Path Finder

Thank you, used part of this with a search, but had to get some assistance.  The final search looked a little like this--did not use two searches, just one:

index=_internal source=*metrics.log group=tcpin_connections
| eval sourceHost=lower(if(isnull(hostname), sourceHost,hostname))
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| join sourceHost
[|tstats values(host) where index=* NOT index=*** NOT index=***| rename values(host) as host
| mvexpand host
| dedup host index
| eval sourceHost= lower(host)
| fields - host]
| dedup sourceHost connectType version
| table sourceHost connectType version
| sort index

 

Hopes this helps anyone else who needs to combine information from two searches.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...