Splunk Search

search query for a series of hosts

ebailey
Communicator

I need to run a query for a number of hosts

i.e. host=app[1-22]* error

using OR between every host is really not workable.

Is this possible with the query language? It does not appear possible to use regex in the query language itself, but I am hoping I am wrong.

Thanks!

Tags (3)

alacercogitatus
SplunkTrust
SplunkTrust

No, regex is not possible at that point of the search. Try this:

host=app* error | rex field=host "app(?<host_number>\d+" | search host_number<23

You can also tag hosts (http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/tagsconf).

[host=app1]
findme = enabled

[host=app2]
findme = enabled

Then search:

host=app* tag::host=findme error

Eldest_Malk
Engager

Looks like you missed the closing parenthesis:

  host=app* error | rex field=host "app(?<host_number>\d+)" | search host_number<23
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...