Splunk Search

How to list hosts in my index according to host name

bearman
Explorer

Greetings!
I'm trying to list part of the hosts in my index but only those that starts off with certain letters (and then a wildcard).
My company has over 10.000 hosts and while not all of them are in my index, I do have over 650 hosts there.
So, what I am trying to do is to have Splunk list all the servers that by platform commonality start off with the letters ucm-.
Another search would ask for Splunk to list all the hosts in my index starting off with the letters mse- since this is a different platform.

I've tried the following:
| metadata type=hosts index=ucv | sort host

I've also tried other variations including:
| metadata type=hosts index=ucv host=ucm | sort host

Splunk however, just lists ALL the hosts in my index instead of the subset of hosts that I'm interested in.
Isn't there some smart way to have a subset of hosts listed and perhaps portrayed in a table with more than only the top ten hosts as in ALL the hosts that starts off with as in either ucm-* or mse-* ?

Thanks!

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Run this over all time:

| tstats count where index=ucv host=ucm* by host

Your approach would also work if you filtered instead of sorted:

| metadata type=hosts index=ucv | search host=ucm*

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Run this over all time:

| tstats count where index=ucv host=ucm* by host

Your approach would also work if you filtered instead of sorted:

| metadata type=hosts index=ucv | search host=ucm*

bearman
Explorer

Fantastic, Martin!
Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...