topic Re: Active computers reporting to splunk last 30 days in Splunk Search https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315075#M94333 <P>index=my_index* | metadata type=hosts</P> <P>Error in 'metadata' command: This command must be the first command of a search.<BR /> The search job has failed due to an error. You may be able view the job in the Job Inspector.</P> Fri, 06 Apr 2018 14:14:08 GMT cyler 2018-04-06T14:14:08Z Active computers reporting to splunk last 30 days https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315070#M94328 <P>I would like to know how to search for all computers that are reporting to Splunk in the last 30 day.</P> <P>Thank you</P> Thu, 05 Apr 2018 18:34:44 GMT https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315070#M94328 cyler 2018-04-05T18:34:44Z Re: Active computers reporting to splunk last 30 days https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315071#M94329 <P>Hi,</P> <P>You should ru search like this one (set time-range picker for last 30 days):</P> <PRE><CODE>index=* | stats count by host </CODE></PRE> <P>This search will show you all hosts and number of events from each other.</P> Thu, 05 Apr 2018 18:40:38 GMT https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315071#M94329 skulk 2018-04-05T18:40:38Z Re: Active computers reporting to splunk last 30 days https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315072#M94330 <P>many ways to go about it ...<BR /> try this <CODE>|metadata type=hosts</CODE> <BR /> see the output of the command and start exploring ...<BR /> heres a link to the doc that has more elaborated examples:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Metadata">http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Metadata</A><BR /> hope it helps</P> Thu, 05 Apr 2018 18:40:47 GMT https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315072#M94330 adonio 2018-04-05T18:40:47Z Re: Active computers reporting to splunk last 30 days https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315073#M94331 <P>You could try these:</P> <PRE><CODE>| tstats latest(_time) AS latest where index=* by host </CODE></PRE> <P>or<BR /> | metadata type=hosts<BR /> Either should work.</P> Thu, 05 Apr 2018 18:41:45 GMT https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315073#M94331 elliotproebstel 2018-04-05T18:41:45Z Re: Active computers reporting to splunk last 30 days https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315074#M94332 <P>Forgive my being naive - Here is what result I get back</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4704i54B29CA005C5FA42/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 06 Apr 2018 14:12:33 GMT https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315074#M94332 cyler 2018-04-06T14:12:33Z Re: Active computers reporting to splunk last 30 days https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315075#M94333 <P>index=my_index* | metadata type=hosts</P> <P>Error in 'metadata' command: This command must be the first command of a search.<BR /> The search job has failed due to an error. You may be able view the job in the Job Inspector.</P> Fri, 06 Apr 2018 14:14:08 GMT https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315075#M94333 cyler 2018-04-06T14:14:08Z Re: Active computers reporting to splunk last 30 days https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315076#M94334 <P>please read the doc<BR /> <CODE>metadata</CODE> is a generating command has to be first <BR /> no need for index = something before<BR /> place this in your searchbae literally <CODE>|metadata type=hosts</CODE></P> Fri, 06 Apr 2018 14:22:58 GMT https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315076#M94334 adonio 2018-04-06T14:22:58Z Re: Active computers reporting to splunk last 30 days https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315077#M94335 <P>get rid of everything before the first pipe</P> Fri, 06 Apr 2018 15:02:27 GMT https://community.splunk.com/t5/Splunk-Search/Active-computers-reporting-to-splunk-last-30-days/m-p/315077#M94335 DalJeanis 2018-04-06T15:02:27Z