Determine host of the searchhead running a SPL

[koshyk]

hi,
we have savedsearches running on Search Heads and need to trigger different alerts based on the environment. The SPL in the savedsearch uses tstats and hence it doesn't have event information but rather statistics only. ( i could have used splunk_server variable to determine if it was events). We do have standards for production environment for hostname (eg starts with p) and we need to determine a logic based on the hostname environment

|tstats count as eventCount by host| <eval hostname of the search head> | search sh_hostname=p* | ...

is there any clever way to integrate hostname of the current search-head into the above search?

[woodcock]

You can do it like this:

| makeresults | addinfo | map [|rest/services/search/jobs/$info_sid$] | table searchProviders splunk_server
| rename COMMENT AS "I believe these will both always be the same value: that of your Search Head"
| search splunk_server="YourServerThatShouldRunThisSearch"
| map [search Your Real Search Here]

[koshyk]

is the $info_sid$ need to be populated? from the above query, the rest endpoint shows me all the search providers just not the search-head where it is running

[gjanders]

Perhaps you could provide more detail as to why the search head running the query changes the query in some way...also did you try groupby splunk_server on the tstats query?

[koshyk]

the Search Head won't change the query, but based on the environment/hostname we need to trigger different alert/severity

[gjanders]

eval or another conditional function of eval could work here...