Getting Data In

How can I add the hosts to the search without it bringing up all the hosts in the index?

rgarbac1
New Member

I need to add the hosts to the search below, such as host = "servername". It currently brings up all the hosts in the index and I only need a few.

| metadata type=sources index=myindex | join source type=outer [ search index=myindex  AND fullload = "]I:  Task is running" 
| bucket span=1h _time 
| stats count  by  source,
 fullload 
| eval Date=strftime(_time,"%m/%d/%Y")]| sort + count| fillnull value=0 |where count = 0  |search TaskName = "*_T1" 
|fields TaskName, count
0 Karma

sushantmhatre
Explorer

you can create lookup of hosts and then filter group of hosts you are looking after

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...