Hi,
I need to perform a search on forwarder data from the `_internal` index, but I need to exclude my indexers from that search.
I know I can get the indexers list by many ways, for example:
index=_internal source="*metrics.log" group=instance instance_roles="*indexer*"
| table host
| dedup host
But how can I use the list to dynamically exclude the hosts from my other `_internal` search?
↧