topic Re: How do I see all Hosts? in Getting Data In

How do I see all Hosts?

philrego — Mon, 29 Jul 2019 17:28:04 GMT

It's only showing "Top 10 Values" for some reason.

Re: How do I see all Hosts?

PowerPacked — Mon, 29 Jul 2019 17:44:20 GMT

You didn't properly mention where you are seeing this behavior.

you can always do stats to list all values in field --- your search | stats count by host

if you are facing issue in timechart, chart command , use this -- ----- your search | timechart count by host useother=f usenull=f

Thanks

Re: How do I see all Hosts?

jacobpevans — Mon, 29 Jul 2019 18:21:33 GMT

To add to @PowerPacked 's correct answer, I am assuming you are seeing this in the "Selected Fields" sidebar. If so, click "host" there, "Top values", then ensure you have "limit=0" as a parameter to the top command, e.g.:

< your base search >
| top limit=0 host

If you only want to see all hosts, the fastest way to do that is with this search (tstats is extremely efficient):

| tstats values(host)

Re: How do I see all Hosts?

philrego — Tue, 30 Jul 2019 03:43:26 GMT

| top limit=0 host
worked but
| tstats values(host)
only entering that in the search showed a bunch of hosts i've never seen and couldn't open at all.

Re: How do I see all Hosts?

chinmoya — Tue, 30 Jul 2019 06:27:14 GMT

Try this

| tstats values(host) where index=* earliest=0

Above will give you a multivalue field. Personally, I prefer the below

| tstats count where index=* earliest=0 by host

Re: How do I see all Hosts?

jacobpevans — Tue, 30 Jul 2019 13:17:18 GMT

I'm not following when you say you "couldn't open at all". The tstats command quickly looks at certain fields such as index, host, and _time stored separately from the raw data. Here's another version of the command that will also show the last time data was reported for each index (building on @chinmoya 's answer):

| tstats count latest(_time) as _time by host

Finally, this is how you would get all events if you are unfamiliar with a specific host. Be sure you run the command with the same time-frame as the previous search.

index=* host=[host_XYZ]

If you're still having trouble, I highly recommend taking the free ~5-hour Splunk Fundamentals I training. You can find more information here: https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html

Re: How do I see all Hosts?

philrego — Tue, 30 Jul 2019 13:34:21 GMT

Means when you click on the hosts and click "View events" or one of the other options. It opens another tab and immediately closed. | tstats values(host) only shows 100 hosts and none are the ones I use. Same thing with | tstats count latest(_time) as _time by host. Cant click on the results and it doesn't show the hosts I use.

Re: How do I see all Hosts?

philrego — Tue, 30 Jul 2019 13:35:16 GMT

It returned 79,227 events. Could I possibly have that many hosts? I don't need access to more than like 30.