Splunk Search

Can metadata command search sourcetypes and host at the same time?

robertlynch2020
Motivator

Hi

I am looking for a way to get the number of events from host=ALL with sourcetype=tps. However it looks like i can't.

I am looking to display all the host that have a TPS sourcetypes. However the below search is giving me all the events for every sourcetype. Can i refine the search? in bold below is not having any impact

| metadata type=hosts index=mlc_log_drop sourcetype=tps | search host=* | rename host as log_drop_name | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | stats first(recentTime) as time, max(project) as project, first(totalCount) as total_events by log_drop_name | rename total_events as TPS_Events | eval TPS_Events=tostring(TPS_Events, "commas")| sort -time | fieldformat time = strftime(time,"%a, %d %b %Y %H:%M:%S") | head 5001

0 Karma

cmerriman
Super Champion

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Metadata

if you're filtering type=host, you cannot search for sourcetype=tps, as metadata only brings back a host column.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...