topic Re: How to write a search to find new hosts that are sending logs to Splunk? in Splunk Search

How to write a search to find new hosts that are sending logs to Splunk?

sumitkathpal — Wed, 04 Jan 2017 11:03:44 GMT

Dear Experts,

We are looking for a search where we can find new hosts that are sending logs to Splunk. I am stuck and don't know where to start.

Any help. Thanks in advance

Re: How to write a search to find new hosts that are sending logs to Splunk?

gcusello — Wed, 04 Jan 2017 11:12:46 GMT

hi sumitkathpal,
You can see which hosts are sending logs to Splunk with this simple search:

index=_internal

If you want to verify if there are new hosts you have to insert your hosts in a lookup and search for them:

index=_internal NOT [ | inputlookup my_hosts.csv | fields host ]

in this way you can find if an host is or not in your lookup.
Bye.
Giuseppe

Re: How to write a search to find new hosts that are sending logs to Splunk?

javiergn — Wed, 04 Jan 2017 11:18:51 GMT

You could try this if you just want to show those new hosts that have reported for the first time since yesterday:

| metadata type=hosts index=_* OR index=*
| where firstTime >= relative_time(now(), "-1d")
| convert timeformat="%Y-%m-%d %T" ctime(firstTime) as firstTime, ctime(lastTime) as lastTime, ctime(recentTime) as recentTime
| table host, firstTime, lastTime, recentTime, Count

Simply modify the relative_time parameters to match your time range needs.

Re: How to write a search to find new hosts that are sending logs to Splunk?

javiergn — Thu, 26 Jan 2017 20:57:08 GMT

Hi,

Did any of the answers below help you?
If so, could you please mark it as answered so that we can close the thread?

Thanks,
J