topic How to create a list of all indexes with source, host, and sourcetype with last seen field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-all-indexes-with-source-host-and/m-p/423030#M121441 <P>Hello all, I'm currently working on figuring how to create a list of as mentioned in the title with the last seen field. <BR /> This field will show when the host was last seen in our logs. </P> <P>It's kind of similar to the solution below but will only list last seen time for all hosts.</P> <P>Thank you in advance for your assistance. </P> <P><A href="https://answers.splunk.com/answers/332987/how-to-search-the-list-of-devices-that-have-sent-l.html">https://answers.splunk.com/answers/332987/how-to-search-the-list-of-devices-that-have-sent-l.html</A></P> Wed, 31 Jul 2019 19:39:51 GMT mpham07 2019-07-31T19:39:51Z How to create a list of all indexes with source, host, and sourcetype with last seen field? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-all-indexes-with-source-host-and/m-p/423030#M121441 <P>Hello all, I'm currently working on figuring how to create a list of as mentioned in the title with the last seen field. <BR /> This field will show when the host was last seen in our logs. </P> <P>It's kind of similar to the solution below but will only list last seen time for all hosts.</P> <P>Thank you in advance for your assistance. </P> <P><A href="https://answers.splunk.com/answers/332987/how-to-search-the-list-of-devices-that-have-sent-l.html">https://answers.splunk.com/answers/332987/how-to-search-the-list-of-devices-that-have-sent-l.html</A></P> Wed, 31 Jul 2019 19:39:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-all-indexes-with-source-host-and/m-p/423030#M121441 mpham07 2019-07-31T19:39:51Z Re: How to create a list of all indexes with source, host, and sourcetype with last seen field? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-all-indexes-with-source-host-and/m-p/423031#M121442 <P>Like this?</P> <PRE><CODE>| tstats latest(_time) as latest where (index=* earliest=-1mon@mon latest=-0h@h) by index host source sourcetype | convert ctime(latest) </CODE></PRE> Wed, 31 Jul 2019 22:30:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-all-indexes-with-source-host-and/m-p/423031#M121442 jaime_ramirez 2019-07-31T22:30:16Z Re: How to create a list of all indexes with source, host, and sourcetype with last seen field? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-all-indexes-with-source-host-and/m-p/423032#M121443 <P>Thank you so much Jaime! Worked out perfectly and extremely fast search. </P> Thu, 01 Aug 2019 13:55:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-list-of-all-indexes-with-source-host-and/m-p/423032#M121443 mpham07 2019-08-01T13:55:42Z