Greetings!
I'm trying to list part of the hosts in my index but only those that starts off with certain letters (and then a wildcard).
My company has over 10.000 hosts and while not all of them are in my index, I do have over 650 hosts there.
So, what I am trying to do is to have Splunk list all the servers that by platform commonality start off with the letters ucm-.
Another search would ask for Splunk to list all the hosts in my index starting off with the letters mse- since this is a different platform.
I've tried the following:
| metadata type=hosts index=ucv | sort host
I've also tried other variations including:
| metadata type=hosts index=ucv host=ucm | sort host
Splunk however, just lists ALL the hosts in my index instead of the subset of hosts that I'm interested in.
Isn't there some smart way to have a subset of hosts listed and perhaps portrayed in a table with more than only the top ten hosts as in ALL the hosts that starts off with as in either ucm-* or mse-* ?
Thanks!
Run this over all time:
| tstats count where index=ucv host=ucm* by host
Your approach would also work if you filtered instead of sorted:
| metadata type=hosts index=ucv | search host=ucm*
Run this over all time:
| tstats count where index=ucv host=ucm* by host
Your approach would also work if you filtered instead of sorted:
| metadata type=hosts index=ucv | search host=ucm*
Fantastic, Martin!
Thank you so much!