Splunk Search

Help with the query that works with splunk server groups

kteng2024
Path Finder

Hi,

Below is the query i am using to get the hostname , IP addresses and last reported to splunk .

| metadata type=hosts index=apache_web splunk_server_group=abc | search [ | makeresults | eval host= apacheweb123 | table host | makemv host delim=" " | mvexpand host | eval host="".host."" | format ] | table host | append [ | makeresults | eval host=apacheweb123 | table host | makemv host delim=" " | mvexpand host ] | join [ search index=_internal hostname=* | stats count by hostname sourceIp | table hostname sourceIp | rename hostname as host ]

But the above search is not working when the server group is mentioned but i need server groups to make search faster over a large data . Any help to get the hostname , IP address , Last reported by including splunk_server_group would be appreciated.

0 Karma

elliotproebstel
Champion

What is your intention with these parts of the query:
| search [ | makeresults | eval host= apacheweb123 | table host | makemv host delim=" " | mvexpand host | eval host="".host."" | format ]
and
| append [ | makeresults | eval host=apacheweb123 | table host | makemv host delim=" " | mvexpand host ]??

The subsearch in the first section returns: NOT() for me, and the subsearch in the second section returns no results. I tried to guess what your intentions might be, but I can't really make sense out of the |table...|makemv...|mvexpand thread, given that you are applying them to a single event to which it looks like you are just intending to assign a string value.

Additionally, | makeresults | eval host=apacheweb123 will not do anything useful, because Splunk treats the apacheweb123 portion as a variable name reference, rather than a string unless you wrap it in double-quotes: | makeresults | eval host="apacheweb123".

Can you explain more about what you're trying to do with all the subsearches?

0 Karma

kteng2024
Path Finder

trying to display the metadata of the host enter by the user .

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...