https://community.splunk.com/t5/Splunk-Cloud-Platform/Searching-all-hosts-in-an-index-for-count/m-p/546053#M601 <P>This will get you the daily counts.</P><LI-CODE lang="markup">index=devices | bin _time span=1d | stats count by _time host</LI-CODE><P>However, if a host has no events, it will not show up. Ways around this include using lookups to retrieve all the valid hosts from a file or key store, or use a longer time frame to retrieve (and possibly dedup) the hosts so you can see if they had event in the time frame of interest.</P> Tue, 30 Mar 2021 17:24:43 GMT ITWhisperer 2021-03-30T17:24:43Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Searching-all-hosts-in-an-index-for-count/m-p/546044#M599 <P>Hello folks,</P><P>I have about 20 hosts that fall under index=devices</P><P>I need a query that will display the count information for each host, once over a 24 hour period.&nbsp;<BR />My intention is to use this to set an alert so that if a host does not have any count in 24 hours, it will send an alert.&nbsp;</P><P>What query would work best for this?&nbsp;</P> Tue, 30 Mar 2021 16:38:44 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Searching-all-hosts-in-an-index-for-count/m-p/546044#M599 verifi81 2021-03-30T16:38:44Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Searching-all-hosts-in-an-index-for-count/m-p/546053#M601 <P>This will get you the daily counts.</P><LI-CODE lang="markup">index=devices | bin _time span=1d | stats count by _time host</LI-CODE><P>However, if a host has no events, it will not show up. Ways around this include using lookups to retrieve all the valid hosts from a file or key store, or use a longer time frame to retrieve (and possibly dedup) the hosts so you can see if they had event in the time frame of interest.</P> Tue, 30 Mar 2021 17:24:43 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Searching-all-hosts-in-an-index-for-count/m-p/546053#M601 ITWhisperer 2021-03-30T17:24:43Z