The search string I am currently using is the following:
| metadata type=hosts |where recentTime < now() - 86400 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen | sort - lastSeen
I would like to be able to use that as a base search but be able to append some more specific filters such as:
host=abc*
index=dns
The first command that came to mind was adding a pipe search at the end, but that doesn't seem to work properly. I know this may be elementary for some of you Splunkers out there, but can anyone offer a quick hand? Much appreciated!
Brian
You can do something like adding the following after the end:
| where host="abc*"
You're going to have to add index
to the list of fields in your fields
command if you want to be able to filter on those, though.
You can append the following
|search host=abc*
I was doing this yesterday and it didn't seem to return any results, but works today. Thanks all for your contributions!