The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.

Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.

Forums: SplunkAdministration: The need to search for a hosts defined "hosttag"

Previous Topic: Splunkd service does not start  |   Next Topic: Setting sourcetype in props.conf on a Windows server


Posts 1–2 of 2
1
posted by: pstein  |  posts
date: November 20, 2009
permalink

I am searching for a host but would also like to add in all the host's hosttag associated with it.

A simple: host=servername hosttag=* doesn't work

I thought there might be a way to add it within Fields, but that didn't work either.
Is there a way within 3.4.9 to add a host's hosttag list?

pstein

2
posted by: gkanapathy  |  posts
date: November 21, 2009
permalink


host=servername | tags | rename tag::host as hosttag

Not sure exactly what you want to do with it, but this will add them and move them to a field named hosttag.