Splunk Search

Search _internal for metrics from non-indexer instances

eden881
Path Finder

Hi,

I need to perform a search on forwarder data from the _internal index, but I need to exclude my indexers from that search.
I know I can get the indexers list by many ways, for example:

index=_internal source="*metrics.log" group=instance instance_roles="*indexer*"
| table host
| dedup host

But how can I use the list to dynamically exclude the hosts from my other _internal search?

0 Karma
1 Solution

MuS
Legend

Hi eden881,

you can exclude the indexers with this SPL example:

index=_internal NOT
    [| tstats count WHERE index=_internal sourcetype=splunkd TERM(metrics) TERM(instance) TERM(indexer) by host
    | table host
    | format ]

The tstats sub search will return a list like ( ( host=1 ) OR ( host=2 ) ... ) that will be excluded from the main search.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi eden881,

you can exclude the indexers with this SPL example:

index=_internal NOT
    [| tstats count WHERE index=_internal sourcetype=splunkd TERM(metrics) TERM(instance) TERM(indexer) by host
    | table host
    | format ]

The tstats sub search will return a list like ( ( host=1 ) OR ( host=2 ) ... ) that will be excluded from the main search.

Hope this helps ...

cheers, MuS

eden881
Path Finder

Thanks! It works well.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...