https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51793#M179625 <P>Need a query to find list of servers reporting to splunk, and send that output to a lookupfile.</P> Mon, 16 Jan 2012 10:45:32 GMT Ravan 2012-01-16T10:45:32Z https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51793#M179625 <P>Need a query to find list of servers reporting to splunk, and send that output to a lookupfile.</P> Mon, 16 Jan 2012 10:45:32 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51793#M179625 Ravan 2012-01-16T10:45:32Z https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51794#M179626 <P>Have a look at the <STRONG>outputlookup</STRONG> search command :</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Outputlookup">http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Outputlookup</A></P> <P>When you say servers <EM>reporting</EM> to Splunk , do you mean a list of Splunk components(forwarders, indexers, search heads etc..) or do you mean the hostname/IP from all sources of data that is indexed in Splunk ?</P> Mon, 16 Jan 2012 20:52:22 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51794#M179626 Damien_Dallimor 2012-01-16T20:52:22Z https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51795#M179627 <P>In this case it is forwarders reporting to splunk</P> Tue, 17 Jan 2012 06:00:48 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51795#M179627 Ravan 2012-01-17T06:00:48Z https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51796#M179628 <P>If it is the hosts(sources) sending data to your Splunk instance that you are interested in, this might work for you:</P> <PRE><CODE>|metadata type=hosts | fields host, firstTime, lastTime, totalCount | eval firstTime=strftime(firstTime, "%Y-%m-%d %H:%M:%S") | eval lastTime=strftime(lastTime, "%Y-%m-%d %H:%M:%S") | sort -totalCount | outputlookup meta_data_hosts.csv </CODE></PRE> Tue, 17 Jan 2012 06:54:41 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51796#M179628 johandk 2012-01-17T06:54:41Z https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51797#M179629 <P>Above Query working fine , but in few results i found reporting date's as 2013/14 year ... Is it problem from splunk server OR clients end ..?</P> Wed, 25 Jan 2012 15:28:33 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-find-servers-reporting-to-splunk/m-p/51797#M179629 Ravan 2012-01-25T15:28:33Z