topic Re: How do I list all sources on a specific host? in Getting Data In

How do I list all sources on a specific host?

toomanyedwards — Wed, 20 Nov 2013 20:44:16 GMT

Hi all, How do I show all sources for a specific host? I can query for a specific host a la: host="myhost" and then hit "source" in the sidebar, but that only shows the top ten sources on that host. I don't know how to see more than that. I have seen an example of how to list all sources for all hosts by host, but that's extremely long running in our environment and not really what we need. I just need to see the sources for specific hosts to verify that our indexing config is setup correctly and the logs that we want to be indexed are showing up as sources. I'm guessing this is any easy one, but I am splunk noob and haven't been able to figure it out. Any help is appreciated. Thanks!

-e

Re: How do I list all sources on a specific host?

jrich523 — Wed, 20 Nov 2013 20:52:08 GMT

host="abc" | dedup source | table field source

Re: How do I list all sources on a specific host?

somesoni2 — Wed, 20 Nov 2013 20:57:36 GMT

This should be the fastest method per my knowledge

|metasearch host="<yourhostname>"

This search will provide following fields:-

host,source,sourcetype,index,splunk_server

From which you can use source field for your requirement.

Re: How do I list all sources on a specific host?

jonahcofer — Wed, 20 Nov 2013 21:12:00 GMT

host="hostname" | stats count by source

Re: How do I list all sources on a specific host?

lukejadamec — Wed, 20 Nov 2013 21:16:45 GMT

The full search would look like this:
|metasearch host="" | dedup source | table source