topic Re: What is the most efficient way to search for unique hosts by a specific index? in Splunk Search

What is the most efficient way to search for unique hosts by a specific index?

victorstarosten — Thu, 23 Oct 2014 18:21:27 GMT

I need to find unique hosts consumed by a specific index.
I use the following search string:

index=my_index
|stats values(host)

As I understand, 'values' returns unique values for 'host'. This gives me what I need, but takes a loooooong time (3+ hours).
Is there a better way?

Thanks!

Re: What is the most efficient way to search for unique hosts by a specific index?

kristian_kolb — Thu, 23 Oct 2014 18:29:16 GMT

Yes, there is a faaar better way;

| metadata type=hosts index=your_index_here

EDIT: and yes. The search actually starts with a pipe.

Re: What is the most efficient way to search for unique hosts by a specific index?

ppablo — Thu, 23 Oct 2014 18:31:53 GMT

I was just about to post that 🙂 Here's the documentation on the metadata command for future reference @victorstarostenko

Cheers!

Re: What is the most efficient way to search for unique hosts by a specific index?

victorstarosten — Thu, 23 Oct 2014 18:37:21 GMT

Perfect.

Thank you.

Re: What is the most efficient way to search for unique hosts by a specific index?

martin_mueller — Thu, 23 Oct 2014 22:42:07 GMT

metadata is the way to go here, but if your stats requirements on indexed fields become more complex you should take a look at tstats: http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/tstats

For example

| tstats count where index=* by index sourcetype host

Will give you a blazingly fast summary of what your Splunk data looks like in those three dimensions.