https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226505#M66797 <PRE><CODE>sourcetype=syslog | stats count by host </CODE></PRE> <P>Or, you could use something like this to see how much data each host is sending:</P> <PRE><CODE>sourcetype=syslog | eval length=len(_raw) | stats sum(length) by host </CODE></PRE> Wed, 02 Mar 2016 14:38:48 GMT vasildavid 2016-03-02T14:38:48Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226504#M66796 <P>Hey Guys </P> <P>So I have a sourcetype of syslog, but under that sourcetype seems to be a whole bunch of hosts. What's the best search to list all the hosts sending under the syslog sourcetype?</P> <P>Sorry for such a basic question, I'm not too bad at making Splunk work, but actually using it for searches etc I'm not so hot.</P> <P>Cheers</P> <P>Aaron</P> Wed, 02 Mar 2016 14:35:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226504#M66796 AaronMoorcroft 2016-03-02T14:35:22Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226505#M66797 <PRE><CODE>sourcetype=syslog | stats count by host </CODE></PRE> <P>Or, you could use something like this to see how much data each host is sending:</P> <PRE><CODE>sourcetype=syslog | eval length=len(_raw) | stats sum(length) by host </CODE></PRE> Wed, 02 Mar 2016 14:38:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226505#M66797 vasildavid 2016-03-02T14:38:48Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226506#M66798 <P>That Iooks to be doing what I need, thank you Sir...</P> Wed, 02 Mar 2016 14:52:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226506#M66798 AaronMoorcroft 2016-03-02T14:52:14Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226507#M66799 <P>Hi Aaron, if you wanted a quick simple count, this might be a good use for tstats, which will usually finish faster than a normal search. </P> <PRE><CODE>| tstats count where sourcetype=syslog by host </CODE></PRE> Wed, 02 Mar 2016 15:04:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226507#M66799 muebel 2016-03-02T15:04:08Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226508#M66800 <P>I can vouch for that</P> Wed, 02 Mar 2016 16:00:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226508#M66800 somesoni2 2016-03-02T16:00:59Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226509#M66801 <P>Thank you, that also seems to work well, no doubt ill be needing more help with some simple searches over the coming days. I have to try and break down everything that is being logged into categories and generally have a tidy up.</P> Wed, 02 Mar 2016 16:42:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-hosts-under-a-certain-sourcetype/m-p/226509#M66801 AaronMoorcroft 2016-03-02T16:42:44Z