What is the criteria for determining "added in the last week?" What if a host was sending data to Splunk a month ago and then stopped sending data for several weeks, and is now sending data again? You need to be a bit more precise about what you want.
Also, what is your definition of "host?" Do you want to go by the host field that users see when they search, or the host names that the forwarders use to identify themselves in the internal logs?