I would like to add which index each of these hosts comes from in this search.
index=_internal source=*/metrics.log component=Metrics host=*hf* group=tcpin* | top limit=10000 hostname host version os arch
I was trying to append a list of servers from just a normal "index=foo" search, but I couldn't get that working.
hostname host version os arch count percent
bar barhost1 5.0.2 Windows x64 556 2.839632
barhost2
Sorry for the formatting.
Also, this search shows us which Heavy Forwarders each device is sending logs to. Instead of having a separate line for each Heavy Forwarder a device is sending to, I'd like to combine those values into 1 field per line, as shown above.
Thanks!
I use an indexed field called, "splunk_forwarder" to identify my heavy forwarders. Using an indexed field allows me to see which HF sent an event, regardless of which sourcetype I'm looking at. Here's a blog post about it.
I use an indexed field called, "splunk_forwarder" to identify my heavy forwarders. Using an indexed field allows me to see which HF sent an event, regardless of which sourcetype I'm looking at. Here's a blog post about it.
But can you see which index that device is associated with?
Yes, then you could do something like index=* splunk_forwarder=* | stats values(index) as indexes by splunk_forwarder
But are you now searching all raw data that way? Instead of using _internal or summarized data?
No, it just adds a new field to all events that get indexed that identifies the sending forwarder.