Splunk Search

Find hosts matching naming criteria in Splunk?

sm600
Explorer

We use this search quite a bit, and love it. In this example it provides a list of all hosts (servers) reporting to splunk in a specific index...

|metadata type=hosts index=ms_ad_log| convert timeformat=" %m/%d/%Y" ctime(*) none(host) none(type) none(totalCount) |rename firstTime AS first, recentTime AS last, totalCount as total | table host,first,last,total | sort - total

But...I need to narrow this search to a specific set of hosts that are named IAA -- and using this search criteria doesn't seem to work....

|metadata type=hosts index=* host=*IAA*| convert timeformat=" %m/%d/%Y" ctime(*) none(host) none(type) none(totalCount) |rename firstTime AS first, recentTime AS last, totalCount as total | table host,first,last,total | sort - total

Any ideas?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi sm600,

@sk314 got it almost correct 😉 Try this:

| metadata type=hosts index=* 
| search host=IAA*
| convert timeformat=" %m/%d/%Y" ctime(*) none(host) none(type) none(totalCount) 
| rename firstTime AS first, recentTime AS last, totalCount as total 
| table host,first,last,total 
| sort - total

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi sm600,

@sk314 got it almost correct 😉 Try this:

| metadata type=hosts index=* 
| search host=IAA*
| convert timeformat=" %m/%d/%Y" ctime(*) none(host) none(type) none(totalCount) 
| rename firstTime AS first, recentTime AS last, totalCount as total 
| table host,first,last,total 
| sort - total

cheers, MuS

sk314
Builder

Not again! 😐 😛

sm600
Explorer

Thanks...adding

|search host=*iaa*| 

worked perfectly

sk314
Builder

Did you try using host=IAA* ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...