https://community.splunk.com/t5/Splunk-Search/query-for-a-list-of-hosts/m-p/270389#M81369 <P>Hi DTERM,</P> <P>using this search:</P> <PRE><CODE>| tstats count WHERE index=* OR sourcetype=* by index,sourcetype, host | stats values(index) AS indexes values(sourcetype) AS sourcetype by host </CODE></PRE> <P>you can list all <CODE>hosts</CODE> sending events and you will also get a list of the <CODE>sourcetype</CODE> and the <CODE>index</CODE> they are sending to.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Mon, 12 Oct 2015 21:28:25 GMT MuS 2015-10-12T21:28:25Z https://community.splunk.com/t5/Splunk-Search/query-for-a-list-of-hosts/m-p/270388#M81368 <P>I have a list of 700+ hosts. I need to verify if those hosts have entries in a splunk instance. So I'm just looking to see if those hosts exist in the logs. How can I query all hosts? Thanks.</P> Mon, 12 Oct 2015 20:43:15 GMT https://community.splunk.com/t5/Splunk-Search/query-for-a-list-of-hosts/m-p/270388#M81368 DTERM 2015-10-12T20:43:15Z https://community.splunk.com/t5/Splunk-Search/query-for-a-list-of-hosts/m-p/270389#M81369 <P>Hi DTERM,</P> <P>using this search:</P> <PRE><CODE>| tstats count WHERE index=* OR sourcetype=* by index,sourcetype, host | stats values(index) AS indexes values(sourcetype) AS sourcetype by host </CODE></PRE> <P>you can list all <CODE>hosts</CODE> sending events and you will also get a list of the <CODE>sourcetype</CODE> and the <CODE>index</CODE> they are sending to.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Mon, 12 Oct 2015 21:28:25 GMT https://community.splunk.com/t5/Splunk-Search/query-for-a-list-of-hosts/m-p/270389#M81369 MuS 2015-10-12T21:28:25Z https://community.splunk.com/t5/Splunk-Search/query-for-a-list-of-hosts/m-p/270390#M81370 <P>try using metadata search</P> <P>|metadata type=hosts</P> Tue, 13 Oct 2015 09:29:27 GMT https://community.splunk.com/t5/Splunk-Search/query-for-a-list-of-hosts/m-p/270390#M81370 sfatnass 2015-10-13T09:29:27Z