Suppose I have a collection of hosts, and I have a search string that works really well when you specify only one host. This is a scheduled search that I would want to run, and one way of doing it seems to be to create a separate saved search for each host. I.E.
host=foo | awesome | search | pipe | line
host=baz | awesome | search | pipe | line
.
.
.
host=lastHost | awesome | search | pipe | line
Is there a good way of configuring splunk to replace the host=foo/baz/.../lastHost part with host=$currenthost and loop through the collection of hosts running the search each time for each host.
Like dwaddle said you should be able to use map. You should be able to loop over the hosts in an index like this:
| metadata type=hosts index=blah | map maxsearches=50 search="search index=blah host=$host$ | awesome | search | pipe | line"
You will have to tune the maxsearches
parameter to your number of hosts, of course.
Yeah I tried it -- didn't know your exact search, so I just appended some search that I knew would bring me back unique results on each host to make sure it worked.
Did you run this? I tried with 3 hosts and it seems to report something. {CODE}| metadata type=hosts | map maxsearches=3 search="search host=$host$ minutesago=1" {CODE} produced some results--without a histogram-- and when I tried 15 hosts splunkd crashed hah
This seems like a good use for the map search command - but I'll be honest I've never come up with a working example of map that does anything useful.
I think for this to work you'd need to custom-script an input that has your list of hosts in it.