Splunk Search

Can we run the query for 100 or so hosts?

danielbb
Motivator

We have the following that runs nicely for one host -

index=<index name> host=<host name> source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
| stats first(MaximumProcessAddressSpace) as AvailableMEM 
| return AvailableMEM

We would like to do it for 100 or so hosts. Any ideas?

Tags (1)
0 Karma

aberkow
Builder

Unclear if you're looking for something more complex, but running the stats command BY host should split this out by host. You can also inputlookup a csv that acts as an IN clause for specific hosts. Examples:

index=<index name>  source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
 | stats first(MaximumProcessAddressSpace) as AvailableMEM BY host

OR

  index=<index name>  source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
[ |inputlookup hostsICareAbout.csv
    |table host]
    | stats first(MaximumProcessAddressSpace) as AvailableMEM BY host

Do these make sense as options/answer your question?

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...