Deployment Architecture

Determine host of the searchhead running a SPL

koshyk
Super Champion

hi,
we have savedsearches running on Search Heads and need to trigger different alerts based on the environment. The SPL in the savedsearch uses tstats and hence it doesn't have event information but rather statistics only. ( i could have used splunk_server variable to determine if it was events). We do have standards for production environment for hostname (eg starts with p) and we need to determine a logic based on the hostname environment

|tstats count as eventCount by host| <eval hostname of the search head> | search sh_hostname=p* | ...

is there any clever way to integrate hostname of the current search-head into the above search?

0 Karma

woodcock
Esteemed Legend

You can do it like this:

| makeresults | addinfo | map [|rest/services/search/jobs/$info_sid$] | table searchProviders splunk_server
| rename COMMENT AS "I believe these will both always be the same value: that of your Search Head"
| search splunk_server="YourServerThatShouldRunThisSearch"
| map [search Your Real Search Here]
0 Karma

koshyk
Super Champion

is the $info_sid$ need to be populated? from the above query, the rest endpoint shows me all the search providers just not the search-head where it is running

0 Karma

gjanders
SplunkTrust
SplunkTrust

Perhaps you could provide more detail as to why the search head running the query changes the query in some way...also did you try groupby splunk_server on the tstats query?

0 Karma

koshyk
Super Champion

the Search Head won't change the query, but based on the environment/hostname we need to trigger different alert/severity

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...