Splunk Search

Search for multiple hosts in parameterized search

petermuller
Explorer

I have a saved search that will take a 'host' parameter, like the following:

|savedsearch "searchName" host="hostName"

This works when I only want to search for one host, but I'm running into an issue where if I want to specify multiple hosts, this format will not work. I cannot do something like the following because it will only take the last available valid host (hostName2 is the one that shows up in the search results.):
|savedsearch "searchName" host="hostName1" OR host="hostName2"

I know that is is possible to use a wildcard (host="hostName*" will return all hosts in this format), but I only want the two specific hosts.

Do you have any suggestions on how to include two different specific hosts in this situation?

This is with Splunk version 5.0.4

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Define your saved search like this:

index=_internal $host$

and call it like this:

| savedsearch host_search host="host=foo OR host=bar"

That'll run a search like this behind the scenes:

index=_internal host=foo OR host=bar 

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Define your saved search like this:

index=_internal $host$

and call it like this:

| savedsearch host_search host="host=foo OR host=bar"

That'll run a search like this behind the scenes:

index=_internal host=foo OR host=bar 

petermuller
Explorer

That is exactly what I needed. I had it defined as host=$host$ before. This solves it. Thanks!

0 Karma

lguinn2
Legend

What about this one?

| foreach hostName1 hostName2 [  savedsearch "searchName" host="<<FIELD>>" ]

petermuller
Explorer

That may work for the most recent Splunk, but I'm on 5.0.4, which does not have that command yet. I edited the description to add the version number.

0 Karma

lguinn2
Legend

Would this work?

|savedsearch "searchName" host="hostName1"
| append [ savedsearch "searchName" host="hostName2" ]

petermuller
Explorer

When doing that, I get this error:

Error in 'SearchParser': Found circular dependency when expanding savedsearch="searchName"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...