https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286052#M21824 <P>Use the metadata command for the quickest solution to this...</P> <PRE><CODE>| metadata type=hosts index=* | fields - firstTime,totalCount,type | eval filterAge=relative_time(now(),"-7d@d") | eval ageInSeconds = (now()-recentTime) | where recentTime &gt; filterAge | convert ctime(lastTime) ctime(recentTime) | table host ageInSeconds lastTime recentTime | sort - ageInSeconds </CODE></PRE> <P>You can adjust the filterAge using Splunk time modifiers.</P> Fri, 16 Sep 2016 08:23:00 GMT esix_splunk 2016-09-16T08:23:00Z https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286051#M21823 <P>Hi,</P> <P>I wanted to know hosts added to our instance in the last 7 days,</P> <P>We want to create a report for this,</P> <P>Kindly help..</P> <P>Thanks in advance</P> Fri, 16 Sep 2016 08:16:25 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286051#M21823 kiran_mh 2016-09-16T08:16:25Z https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286052#M21824 <P>Use the metadata command for the quickest solution to this...</P> <PRE><CODE>| metadata type=hosts index=* | fields - firstTime,totalCount,type | eval filterAge=relative_time(now(),"-7d@d") | eval ageInSeconds = (now()-recentTime) | where recentTime &gt; filterAge | convert ctime(lastTime) ctime(recentTime) | table host ageInSeconds lastTime recentTime | sort - ageInSeconds </CODE></PRE> <P>You can adjust the filterAge using Splunk time modifiers.</P> Fri, 16 Sep 2016 08:23:00 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286052#M21824 esix_splunk 2016-09-16T08:23:00Z https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286053#M21825 <P>thanks for your reply..</P> <P>In the given query we are getting hosts which were added way before 7 days , actually we wanted to get a list of only new hosts added to our instance</P> Wed, 21 Sep 2016 08:59:53 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286053#M21825 kiran_mh 2016-09-21T08:59:53Z https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286054#M21826 <P>tested and working fine.. </P> <PRE><CODE>| metadata type=hosts |eval SevenDaysBack = relative_time(now(), "-7d@d") | where firstTime &gt; SevenDaysBack | eval hostAdded=strftime(firstTime, "%d-%m-%Y %H:%M") | table host, hostAdded | sort hostAdded </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1864i8C2CD26C3DF0FBAB/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 21 Sep 2016 10:42:32 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-get-list-of-hosts-added-to-our-instance-in-the-last-7/m-p/286054#M21826 inventsekar 2016-09-21T10:42:32Z