Refine your search:

I am using this search:

| metadata index=* type=hosts | eval age = now()-lastTime | where age > (2*86400) | sort age d | convert ctime(lastTime) | fields age,host,lastTime

which works great in showing me systems that have not forwarded anything in two days. However, one of my co-workers is playing around with a temp_index into which he is importing data from another splunk instance from which he exported some old logs. This index has hosts in it which are no longer forwarders, and I thought that perhaps I could add after index=* NOT index=temp_index -- but, alas, this does not work. I could, I suppose list all of the indexes I want but then I'd have to change the saved search every time I add a new index, which I will be doing over the next few months. Seems like there should be a way to do this. Anyone know how?

asked 19 Jul '11, 15:59

wrangler2x's gravatar image

wrangler2x
22127
accept rate: 22%

edited 19 Jul '11, 16:13

gkanapathy's gravatar image

gkanapathy ♦
32.6k4827


One Answer:

is there another regex that you can use?

index="hosts*"

link

answered 20 Jul '11, 09:21

fk319's gravatar image

fk319
479213
accept rate: 22%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×101

Asked: 19 Jul '11, 15:59

Seen: 1,307 times

Last updated: 20 Jul '11, 09:21

Copyright © 2005-2012 Splunk Inc. All rights reserved.