Splunk Search

metadata search for distributed environment

sanju005ind
Communicator

I have 4 servers in a distributed environment. I use server a to login and do the search.

When I use the search | metadata type=hosts I get all the hosts from all the servers And When I use | metadata type=hosts splunk_server=B I get the hosts from Server B.

But when I use | metadata type=hosts splunk_server!=D I still get all the servers hosts. also it does not allow to have multiple splunk_server in a metadata search. I Also tried | metadata type=hosts NOT splunk_server=D.

Bottonline is I want the metadata hosts only from Server A,B and C and not D.

Tags (1)
0 Karma
1 Solution

Simeon
Splunk Employee
Splunk Employee

Currently, the metadata search does not appear to handle multiple splunk_server values and NOT operators.

View solution in original post

Dan
Splunk Employee
Splunk Employee

Perhaps you can use the join command in conjunction with single splunk_server metadata queries

0 Karma

Simeon
Splunk Employee
Splunk Employee

Currently, the metadata search does not appear to handle multiple splunk_server values and NOT operators.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...