Deployment Architecture

Hosts added to Splunk instance

kiran_mh
Explorer

Hi,

How to get list of hosts added to our splunk instance in the past week?

Thanks in Advance

Tags (1)
0 Karma

neelshah
Path Finder

This Query will give you All host sending data in last 7 days

index=* earliest=-7d@d latest=now() | stats count by index, host, source, sourcetype

This Query will give you all Host sending data in before 7 days

index=* latest=-7d@d | stats count by index, host, source, sourcetype

Try comparing both will give you new hosts added this week

0 Karma

lguinn2
Legend

What is the criteria for determining "added in the last week?" What if a host was sending data to Splunk a month ago and then stopped sending data for several weeks, and is now sending data again? You need to be a bit more precise about what you want.

Also, what is your definition of "host?" Do you want to go by the host field that users see when they search, or the host names that the forwarders use to identify themselves in the internal logs?

0 Karma

kiran_mh
Explorer

Hi lguinn,

"added in the last week" refers to hosts that are added in the past week irrespective of they are sending data or not, the very first existence of the host in the splunk instance.

In our instance host refers to the names in the host field that users can see....

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!