https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695247#M10305 <P>Try something like this</P><LI-CODE lang="markup">|tstats max(_time) as _time, where index=windows [|metadata type=hosts index=win index=linux | eval now=now() | eval diff= now - lastTime | where diff &gt; 18000 | table host ] by host,index</LI-CODE> Mon, 05 Aug 2024 12:17:38 GMT ITWhisperer 2024-08-05T12:17:38Z https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695239#M10302 <P>I have following search. how can I add indexes information in the results:</P><P>|tstats max(_time) as _time, where index=windows by host,index<BR />|append [|metadata type=hosts index=win index=linux&nbsp; ]<BR />| eval now=now() | eval diff= now - lastTime | search diff &gt; 18000 | eval notreportingsince=tostring(diff,"duration")<BR />| table host lastTime notreportingsince | convert ctime(lastTime) as lastTime<BR />| table host notreportingsince lastTime,index</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 05 Aug 2024 11:29:16 GMT https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695239#M10302 raiqb01 2024-08-05T11:29:16Z https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695243#M10303 <P>What is it that you are trying to achieve that metadata is not giving you?</P> Mon, 05 Aug 2024 11:39:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695243#M10303 ITWhisperer 2024-08-05T11:39:24Z https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695244#M10304 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;, I just need a list of hosts which are not reporting since last 5 days along with index information.</P> Mon, 05 Aug 2024 11:48:13 GMT https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695244#M10304 raiqb01 2024-08-05T11:48:13Z https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695247#M10305 <P>Try something like this</P><LI-CODE lang="markup">|tstats max(_time) as _time, where index=windows [|metadata type=hosts index=win index=linux | eval now=now() | eval diff= now - lastTime | where diff &gt; 18000 | table host ] by host,index</LI-CODE> Mon, 05 Aug 2024 12:17:38 GMT https://community.splunk.com/t5/Monitoring-Splunk/hosts-not-reporting/m-p/695247#M10305 ITWhisperer 2024-08-05T12:17:38Z