https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163463#M46409 <P>If you prefer the other way, (date at columns, rows as hosts )</P> <PRE><CODE>&lt; mysearch &gt; | bucket _time span=1d |convert ctime(_time) AS date timeformat="%Y/%m/%d" | chart count over host by date </CODE></PRE> Mon, 22 Dec 2014 17:44:53 GMT yannK 2014-12-22T17:44:53Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163460#M46406 <P>I am sure that this has been asked and answered but I cant find a format that gives me what I am looking for.</P> <P>I would like to get a list of hosts and the count of events per day from that host that have been indexed. Essentially I would like to take this to management and show ROI that looks at the millions of events each day from these hosts that have been indexed.</P> <P>So it would show</P> <P>Hosts 12/1 12/2 12/3 12/4 (last 7 or 30 days)<BR /> Host1 xxxx xxxx xxxx xxxx<BR /> Host 2 xxxx xxxx xxxx xxxx<BR /> Firewall xxxx xxxx xxxx xxxx<BR /> etc</P> <P>xxxx = number of events indexed</P> <P>Any help is appreciated - thanks</P> Mon, 22 Dec 2014 15:38:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163460#M46406 dolejh76 2014-12-22T15:38:03Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163461#M46407 <P>Hi dolejh76,</P> <P>try something like this:</P> <PRE><CODE>your base search here | timechart span=1d count by host </CODE></PRE> <P>hope it helps ...</P> <P>cheers, MuS</P> Mon, 22 Dec 2014 15:42:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163461#M46407 MuS 2014-12-22T15:42:47Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163462#M46408 <P>That helped thanks - one more for you - what about size in KB for the same data? This way I can show how much of our license each host is chewing up per day?</P> <P>Thanks<BR /> John</P> Mon, 22 Dec 2014 17:19:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163462#M46408 dolejh76 2014-12-22T17:19:33Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163463#M46409 <P>If you prefer the other way, (date at columns, rows as hosts )</P> <PRE><CODE>&lt; mysearch &gt; | bucket _time span=1d |convert ctime(_time) AS date timeformat="%Y/%m/%d" | chart count over host by date </CODE></PRE> Mon, 22 Dec 2014 17:44:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163463#M46409 yannK 2014-12-22T17:44:53Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163464#M46410 <P>Sure, on your license master search the internal index for the source <CODE>license_usage.log</CODE> like this:</P> <PRE><CODE>index=_internal source="*license_usage.log" | timechart span=1d sum(eval(b/1024)) AS KB by h | rename h AS host </CODE></PRE> <P>cheers, MuS</P> Mon, 22 Dec 2014 22:36:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163464#M46410 MuS 2014-12-22T22:36:28Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163465#M46411 <P>I like this report - unfortunately... there is a NULL field that has a considerable amount of data usage? Any idea what that would be? At this point we are ONLY pulling in wineventlogs and AD data - so it shouldn't be this high...</P> <P>Looks like there is an "OTHER" Field as well.... so what is "OTHER" and "NULL"</P> <P>Thanks<BR /> JD</P> Wed, 24 Dec 2014 17:16:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163465#M46411 dolejh76 2014-12-24T17:16:30Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163466#M46412 <P>see the docs about <CODE>timechart tc options</CODE> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Timechart#tc_options">http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Timechart#tc_options</A></P> Fri, 26 Dec 2014 09:18:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-list-of-hosts-and-the-count-of-events-that/m-p/163466#M46412 MuS 2014-12-26T09:18:02Z