Splunk Search

Can we run the query for 100 or so hosts?

danielbb
Motivator

We have the following that runs nicely for one host -

index=<index name> host=<host name> source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
| stats first(MaximumProcessAddressSpace) as AvailableMEM 
| return AvailableMEM

We would like to do it for 100 or so hosts. Any ideas?

Tags (1)
0 Karma

aberkow
Builder

Unclear if you're looking for something more complex, but running the stats command BY host should split this out by host. You can also inputlookup a csv that acts as an IN clause for specific hosts. Examples:

index=<index name>  source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
 | stats first(MaximumProcessAddressSpace) as AvailableMEM BY host

OR

  index=<index name>  source=<source name> sourcetype=<sourcetype name> earliest=-7d MaximumProcessAddressSpace 
[ |inputlookup hostsICareAbout.csv
    |table host]
    | stats first(MaximumProcessAddressSpace) as AvailableMEM BY host

Do these make sense as options/answer your question?

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...