Splunk Search

Filtering for specific hosts or indexes

ebdavis333
New Member

The search string I am currently using is the following:

| metadata type=hosts |where recentTime < now() - 86400 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen | sort - lastSeen

I would like to be able to use that as a base search but be able to append some more specific filters such as:

host=abc*

index=dns

The first command that came to mind was adding a pipe search at the end, but that doesn't seem to work properly. I know this may be elementary for some of you Splunkers out there, but can anyone offer a quick hand? Much appreciated!

Brian

Tags (2)
0 Karma
1 Solution

pradeepkumarg
Influencer

You can append the following

|search host=abc*

View solution in original post

aweitzman
Motivator

You can do something like adding the following after the end:

| where host="abc*"

You're going to have to add index to the list of fields in your fields command if you want to be able to filter on those, though.

0 Karma

pradeepkumarg
Influencer

You can append the following

|search host=abc*

ebdavis333
New Member

I was doing this yesterday and it didn't seem to return any results, but works today. Thanks all for your contributions!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...