Hi,
Below is the query i am using to get the hostname , IP addresses and last reported to splunk .
| metadata type=hosts index=apache_web splunk_server_group=abc | search [ | makeresults | eval host= apacheweb123 | table host | makemv host delim=" " | mvexpand host | eval host="".host."" | format ] | table host | append [ | makeresults | eval host=apacheweb123 | table host | makemv host delim=" " | mvexpand host ] | join [ search index=_internal hostname=* | stats count by hostname sourceIp | table hostname sourceIp | rename hostname as host ]
But the above search is not working when the server group is mentioned but i need server groups to make search faster over a large data . Any help to get the hostname , IP address , Last reported by including splunk_server_group would be appreciated.
What is your intention with these parts of the query:
| search [ | makeresults | eval host= apacheweb123 | table host | makemv host delim=" " | mvexpand host | eval host="".host."" | format ]
and
| append [ | makeresults | eval host=apacheweb123 | table host | makemv host delim=" " | mvexpand host ]
??
The subsearch in the first section returns: NOT()
for me, and the subsearch in the second section returns no results. I tried to guess what your intentions might be, but I can't really make sense out of the |table...|makemv...|mvexpand
thread, given that you are applying them to a single event to which it looks like you are just intending to assign a string value.
Additionally, | makeresults | eval host=apacheweb123
will not do anything useful, because Splunk treats the apacheweb123
portion as a variable name reference, rather than a string unless you wrap it in double-quotes: | makeresults | eval host="apacheweb123"
.
Can you explain more about what you're trying to do with all the subsearches?
trying to display the metadata of the host enter by the user .