Splunk Search

multiple host input listing in splunk query (search & Reporting)

p544gm
Explorer

i am seeking a way to define a variable where i can define a static list of hosts to (re-)use in adhoc searches

Example instead of doing this everytime

          index=os host=hosta OR host=hostb OR host=hostc ....host=hostnn

Instead do something like this 

          index=os host=$MY_HOSTLIST_VAR

I've been trying to do something with Lookup csv file which I uploaded, but can't seem to get that syntax correct.

Labels (1)
0 Karma
1 Solution

impurush
Contributor

You can create an eventtype with all the hosts you want in the queries and use the eventtype in your query.

Example:

Create a eventtype=host_list
host=hosta OR host=hostb OR host=hostc

Then use in your query
index=os eventtype=host_list

View solution in original post

Tags (1)

p544gm
Explorer

Thanks worked!

0 Karma

impurush
Contributor

You can create an eventtype with all the hosts you want in the queries and use the eventtype in your query.

Example:

Create a eventtype=host_list
host=hosta OR host=hostb OR host=hostc

Then use in your query
index=os eventtype=host_list

Tags (1)
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...