https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582958#M11359 <P>And how would you want to distinguish those servers? Let's assume that you have several dozens of servers, each writing events via syslog to a central server from which you read those events from a file.</P><P>Your source is /var/log/whatever.log since it's read from a file. Your devices are dumb and cannot send FQDN as hostname so they only all send "router1" as name.</P><P>How would you go about deciding how many router1's are there?</P><P>It can be done in some particular cases, but in many cases - no.</P><P>Of course you can list sources or hosts from each index (that's trivial to do) but there's nothing except good practice and convention that would guarantee that such list would be complete and reliable.</P> Fri, 28 Jan 2022 17:54:45 GMT PickleRick 2022-01-28T17:54:45Z https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582942#M11357 <P>I work in a large environment, Splunk Ent + ES ( SH &amp; Indexer clustered). I need to see what network servers are viewed / contained / monitored in any of indexes. Any help / SPLs are much appreciated.</P> Fri, 28 Jan 2022 16:14:53 GMT https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582942#M11357 SamHTexas 2022-01-28T16:14:53Z https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582958#M11359 <P>And how would you want to distinguish those servers? Let's assume that you have several dozens of servers, each writing events via syslog to a central server from which you read those events from a file.</P><P>Your source is /var/log/whatever.log since it's read from a file. Your devices are dumb and cannot send FQDN as hostname so they only all send "router1" as name.</P><P>How would you go about deciding how many router1's are there?</P><P>It can be done in some particular cases, but in many cases - no.</P><P>Of course you can list sources or hosts from each index (that's trivial to do) but there's nothing except good practice and convention that would guarantee that such list would be complete and reliable.</P> Fri, 28 Jan 2022 17:54:45 GMT https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582958#M11359 PickleRick 2022-01-28T17:54:45Z https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582969#M11361 <P>I appreciate your help. I would like to see the list of servers's name ( machine names). I believe this list of servers would show that they are being monitored correct? So, is there a SPL you may share that would show mw this list of servers? We do have about 100 indexes. Thanks buddy.</P> Fri, 28 Jan 2022 18:37:04 GMT https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582969#M11361 SamHTexas 2022-01-28T18:37:04Z https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582970#M11362 <P>Index =*|stats count by host</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 28 Jan 2022 18:41:29 GMT https://community.splunk.com/t5/Splunk-Enterprise/Need-help-with-an-SPL-to-check-an-Index-to-see-list-of-servers/m-p/582970#M11362 SinghK 2022-01-28T18:41:29Z