topic Re: newbe question: How do I list machines reporting to my splunk server? in Getting Data In

newbe question: How do I list machines reporting to my splunk server?

jawehren — Sat, 23 Oct 2010 00:53:07 GMT

How do I list machines reporting to my server?

Re: newbe question: How do I list machines reporting to my splunk server?

southeringtonp — Sat, 23 Oct 2010 00:55:41 GMT

Run the following search:

| metadata hosts

Re: newbe question: How do I list machines reporting to my splunk server?

muebel — Sat, 23 Oct 2010 03:30:08 GMT

Here are a couple searches that will get a list of hosts. This one will give you all machines in last 10 minutes reporting in:

* minutesago=10 | dedup host | stats list(host)

you can run this over any time frame you want... minutesago=30? Or, you can use the time picker and select "custom time" to look at all host reporting in during the time frame of your choice.

Here is another search that gives you all hosts reporting in, but also the number of events from each host:

* minutesago=10 | chart count(host) by host

The above search will give you each host reporting in during last 10 minutes, and also the number of events from that host. Lets you see who is most active.

Re: newbe question: How do I list machines reporting to my splunk server?

ftk — Sat, 23 Oct 2010 04:02:36 GMT

This search will give you all hosts reporting to your indexer and the last time they forwarded data.

| metadata type=hosts index=foo | eval last_contact=now()-recentTime