Splunk Search

help on subsearch field matching

jip31
Motivator

Hi

I use actually the search below in order to doing a match between a search and a workstation name (host)

    eventtype=Charge AND (host=toto OR host=tata OR host=titi)

But I have a huge list of host so I have to find another solution

I tried this but I have no results
eventtype=Charge AND index=”tutu” sourcetype="tete" “$IND$”
“$IND$” is a flag that I can find in host=toto OR host=tata OR host=titi in order to identify these machines
It's strange because when I m just doing index=”tutu” sourcetype="tete" “$IND$”, it returns me the good host list
What is the issue please?

So I planned to do something like this :

eventtype=Charge [|inputlookup host.csv]

OR

eventtype=Charge 
| join host type="outer" 
    [ search index=”tutu” sourcetype="tete" “$IND$”]

What is the best way to do what I want?
Is there other solutions
Thanks for you help

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

eventtype=Charge AND index=”tutu” sourcetype="tete" “$IND$” is not using a subsearch, you're just adding extra search criteria.

Try: eventtype=Charge [ search index=”tutu” sourcetype="tete" “$IND$”| stats count by host | table host ]

See also: https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

View solution in original post

0 Karma

FrankVl
Ultra Champion

eventtype=Charge AND index=”tutu” sourcetype="tete" “$IND$” is not using a subsearch, you're just adding extra search criteria.

Try: eventtype=Charge [ search index=”tutu” sourcetype="tete" “$IND$”| stats count by host | table host ]

See also: https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...