https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261064#M21676 <P>What is the criteria for determining "added in the last week?" What if a host was sending data to Splunk a month ago and then stopped sending data for several weeks, and is now sending data again? You need to be a bit more precise about what you want.</P> <P>Also, what is your definition of "host?" Do you want to go by the host field that users see when they search, or the host names that the forwarders use to identify themselves in the internal logs?</P> Sat, 22 Oct 2016 08:52:13 GMT lguinn2 2016-10-22T08:52:13Z https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261063#M21675 <P>Hi,</P> <P>How to get list of hosts added to our splunk instance in the past week?</P> <P>Thanks in Advance</P> Thu, 20 Oct 2016 11:06:05 GMT https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261063#M21675 kiran_mh 2016-10-20T11:06:05Z https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261064#M21676 <P>What is the criteria for determining "added in the last week?" What if a host was sending data to Splunk a month ago and then stopped sending data for several weeks, and is now sending data again? You need to be a bit more precise about what you want.</P> <P>Also, what is your definition of "host?" Do you want to go by the host field that users see when they search, or the host names that the forwarders use to identify themselves in the internal logs?</P> Sat, 22 Oct 2016 08:52:13 GMT https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261064#M21676 lguinn2 2016-10-22T08:52:13Z https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261065#M21677 <P>Hi lguinn,</P> <P>"added in the last week" refers to hosts that are added in the past week irrespective of they are sending data or not, the very first existence of the host in the splunk instance.</P> <P>In our instance host refers to the names in the host field that users can see....</P> Fri, 18 Nov 2016 08:06:46 GMT https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261065#M21677 kiran_mh 2016-11-18T08:06:46Z https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261066#M21678 <P>This Query will give you All host sending data in last 7 days</P> <P>index=* earliest=-7d@d latest=now() | stats count by index, host, source, sourcetype</P> <P>This Query will give you all Host sending data in before 7 days</P> <P>index=* latest=-7d@d | stats count by index, host, source, sourcetype</P> <P>Try comparing both will give you new hosts added this week</P> Fri, 18 Nov 2016 09:50:43 GMT https://community.splunk.com/t5/Deployment-Architecture/Hosts-added-to-Splunk-instance/m-p/261066#M21678 neelshah 2016-11-18T09:50:43Z