Splunk Search

Best method for multiple inputs for a search

a212830
Champion

Hi,

I have a search that is going to require a fair amount of inputs (4 hosts, and 5 or 6 filesystems per host) to monitor disk space. What is the best practice for doing a search like this? I don't want to hard-code it. Could it take an input as a lookup? If so, how would I pass two variables into the search?

TIA...

0 Karma

woodcock
Esteemed Legend

I assume the reason you are not interested in hardcoding it is because the search is going to be part of a large number of other searches or dashboards and hardcoding something that is replicated in a large number of other places means maintenance on it when it changes is very cumbersome. If this is the case, you should create an eventtype using the search and then reference the eventtype in your dashboards and other searches. Then, when you have to change your base search, you just change it in the eventtype and instantly all the other searches are updated at the same time. For example, you might have a large number of hosts that you need to discriminate as "Customer X" you can do this:

In eventtypes.conf

[CUSTOMER_X]
search = index="myIndex" sourcetype=mySourcetype host=A OR host=B OR host=C OR host=D

Then in your searches:

eventtype=CUSTOMER_X
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...