Hi All, I have used the below query to capture the splunk service status (Up or Down) via splunkd.log. This query is working fine, but we have added few more splunk instance to the current environment and we need to capture these splunk service status along with the old splunk instances. My requirement is to include the newly build splunk host details to pull their service status.
Newly build host starts with the letter vms , so how to add this host name along with host name hs
Query details :
index=_internal host=hs* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures
thanks in advance.
Hi Hemnaath, Please check -
index=_internal host=hs* OR host=vms* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures
Hi Hemnaath, Please check -
index=_internal host=hs* OR host=vms* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures
Hi Hemanth
If the query is same just use the OR operator for the host like mentioned below,
index=------ host=hs* OR host=vms* -----query--------
thanks it worked, at same time could please tell me where we need to use OR operator and AND operator appropriately in SPL query. thanks in advance.