Splunk Search

Splunk query to filter results

tejaswiniul
Explorer

I have some code deployed on 1 out of my 6 servers. I need a splunk query that pulls data from the other 5 hosts. Something like - All except this 1 host. I know the host option in splunk to look for the host's logs, but I have no idea how to do all except 1. Can someone please assist me?

The one box I am talking about has my latest code changes, and the other 5 have my old code. So I want to write a query to do a before vs after analysis.

Tags (1)
0 Karma

javiergn
SplunkTrust
SplunkTrust

Couple of options below.

Specify the 5 servers directly with an OR:

index=foo sourcetype=bar (host=host1 OR host=host2 OR host=host3 OR host=host4 OR host=host5)

Assuming your sourcetype/index contains data that refers to those 6 hosts and only those you can do a "return all but this one":

 index=foo sourcetype=bar host!=hostIdontwanttosee
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...