https://community.splunk.com/t5/Getting-Data-In/Number-of-hosts-over-time/m-p/93939#M19546 <P>This will give what you want.</P> <PRE><CODE>index=_internal per_host_thruput | timechart span=1d dc(series) as hosts </CODE></PRE> <P>dc is short for distinct count and series contains the host name in the per_host group</P> Wed, 17 Oct 2012 22:25:19 GMT BobM 2012-10-17T22:25:19Z https://community.splunk.com/t5/Getting-Data-In/Number-of-hosts-over-time/m-p/93938#M19545 <P>I am looking for a good way to show the number of host that are sending log files to splunk over time</P> <P>I can use timechart but how do I count uniq host names and from what index. I tried _internal for the metrics and summary but when i use uniq or dedup it kills my timchart function.</P> <P>How to get the number for each day over a 30 day????</P> <P>I tried this:</P> <PRE><CODE>index=_internal hostname="*" component="Metrics" | timechart span=d count(uniq hostname) </CODE></PRE> <P>But that's not right. anyone know the right way??</P> Wed, 17 Oct 2012 22:04:58 GMT https://community.splunk.com/t5/Getting-Data-In/Number-of-hosts-over-time/m-p/93938#M19545 hartfoml 2012-10-17T22:04:58Z https://community.splunk.com/t5/Getting-Data-In/Number-of-hosts-over-time/m-p/93939#M19546 <P>This will give what you want.</P> <PRE><CODE>index=_internal per_host_thruput | timechart span=1d dc(series) as hosts </CODE></PRE> <P>dc is short for distinct count and series contains the host name in the per_host group</P> Wed, 17 Oct 2012 22:25:19 GMT https://community.splunk.com/t5/Getting-Data-In/Number-of-hosts-over-time/m-p/93939#M19546 BobM 2012-10-17T22:25:19Z