https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-report-hosts-counts-of-sources-and/m-p/197061#M56910 <P>It appears this will do what I am looking for. I will work on the formatting -- Thank you for the answer.</P> Wed, 27 Aug 2014 21:26:44 GMT Ronvgraham 2014-08-27T21:26:44Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-report-hosts-counts-of-sources-and/m-p/197059#M56908 <P>I would like to be able to create/run a report that would show me the hosts, sourcetypes for each host, and the sources for each sourcetype. For the sourcetypes and sources, I would like to have beginning date, and end date for each along with a count. Similar to what I find on the data summary page on the main search page but in a more hierarchical structure. It would look something like this:</P> <P>Host(s)-&gt;Sourcetypes-&gt;Sources with Begin Date, End Date and Count for Sourcetypes and Sources</P> <P>Does a report like this exist in any of the splunk apps or is there a way to create this easily? As we expanded to have multiple indexers, this would be very valuable in documenting what is on each of the indexers for the team and key employees through the institution. It would also be helpful for identifying information that does not need to be indexed or is missing on each of the servers. </P> <P>Thank you for any help you can provide</P> Wed, 27 Aug 2014 16:05:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-report-hosts-counts-of-sources-and/m-p/197059#M56908 Ronvgraham 2014-08-27T16:05:53Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-report-hosts-counts-of-sources-and/m-p/197060#M56909 <P>Well not strictly exactly the output format you're after, but you can have lots of fun with <CODE>tstats</CODE>. This would be one idea:</P> <PRE><CODE>| tstats earliest(_time) as begin_date,latest(_time) as end_date, count by host,sourcetype,source | convert ctime(begin_date) ctime(end_date) </CODE></PRE> Wed, 27 Aug 2014 19:40:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-report-hosts-counts-of-sources-and/m-p/197060#M56909 Ayn 2014-08-27T19:40:16Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-report-hosts-counts-of-sources-and/m-p/197061#M56910 <P>It appears this will do what I am looking for. I will work on the formatting -- Thank you for the answer.</P> Wed, 27 Aug 2014 21:26:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-report-hosts-counts-of-sources-and/m-p/197061#M56910 Ronvgraham 2014-08-27T21:26:44Z