https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200320#M58064 <P>The number to hosts have increased in our instance &amp; we want to check which ones are the new ones added. Also we want to get alerted on a weekly basis if a new host gets added. Can anyone let me know the query to check the newly added hosts?</P> <P>Thanks in Advance.</P> Mon, 19 Sep 2016 09:54:26 GMT abhijit_mhatre 2016-09-19T09:54:26Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200320#M58064 <P>The number to hosts have increased in our instance &amp; we want to check which ones are the new ones added. Also we want to get alerted on a weekly basis if a new host gets added. Can anyone let me know the query to check the newly added hosts?</P> <P>Thanks in Advance.</P> Mon, 19 Sep 2016 09:54:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200320#M58064 abhijit_mhatre 2016-09-19T09:54:26Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200321#M58065 <P>i am not sure if there is any direct way available for this one.. but, we can find out the first message from a host and approximately, we can assume that date as the host added date. <BR /> i am querying only head 100 hosts(oldest 100 hosts).. we can use tail 100 to get most recent 100 hosts. </P> <PRE><CODE>| metadata type=hosts | head 100 | fields host firstTime lastTime totalCount | sort -totalCount | fieldformat firstTime=strftime(firstTime,"%x %X") | fieldformat lastTime=strftime(lastTime,"%x %X") </CODE></PRE> Mon, 19 Sep 2016 10:17:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200321#M58065 inventsekar 2016-09-19T10:17:26Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200322#M58066 <P>Hi abhijit, if you want to query date wise, lets say, new hosts added last week, then - <BR /> tested and working fine..</P> <PRE><CODE> | metadata type=hosts |eval SevenDaysBack = relative_time(now(), "-7d@d") | where firstTime &gt; SevenDaysBack | eval hostAdded=strftime(firstTime, "%d-%m-%Y %H:%M") | table host, hostAdded | sort hostAdded </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1869iA640140D29D41B2E/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 21 Sep 2016 11:06:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200322#M58066 inventsekar 2016-09-21T11:06:14Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200323#M58067 <P>Thanks @inventsekar for your help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 21 Sep 2016 13:16:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-new-hosts-get-added-to-instance-get-alerted/m-p/200323#M58067 abhijit_mhatre 2016-09-21T13:16:36Z