topic Re: List all reporting devices per Splunk server in Reporting

List all reporting devices per Splunk server

rbruno7 — Tue, 13 Apr 2010 10:09:01 GMT

Hi There,

Here goes my first question.

I need to generate a list of all hosts reporting to each splunk server so I can properly migrate the servers reporting to Splunk-A server to a different Splunk-B instanc on a different data center.

Since most servers don' report every day I need to search on a large timeframe (some report once a week and others once a month).

The first command command that came to my mind is below:

index=company_host OR index=company_network startdaysago=30 | stats distinct_count(host) by splunk_server,host

It does the job but it is incredibly slow and heavy on the Splunk infrastructure.

Is there any magic way to get it done faster without relying on summary indexes?

Best Regards

Re: List all reporting devices per Splunk server

gkanapathy — Tue, 13 Apr 2010 21:10:00 GMT

Just use:

| metadata type=hosts

Unfortunately, the |metadata command always runs in distributed mode and does not break out results by splunk_server, so you might have to figure out a way to run it in non-distributed mode on each individual server to get the list for each indexer.

You could also just go into the $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ directory (or wherever you keep your indexes hot/warm db) and look in the Hosts.data file on each server, and repeat for each index you're interested in.

Re: List all reporting devices per Splunk server

rbruno7 — Wed, 14 Apr 2010 00:01:41 GMT

This was the magic answer I was looking for!
Thank you!

Re: List all reporting devices per Splunk server

blebit — Mon, 26 May 2014 06:41:41 GMT

great answer