How can I get a list of all hosts plus their sources from Splunk?

[Glenn]

I often get asked by app teams "how can I see all the log files that are being monitored for my app servers" (they don't have access to see their forwarders inputs.conf and I'd rather not do it for them) or from IT security "how can I see all the sources of data that we are monitoring and where they are being monitored for the whole environment, so we can make sure we are covered".

I have not been able to find out a good way to do this so far at all, other than to do a search like:

* | stats count by host source

...which is ridiculously slow with our massive volume of data, and of course could miss out any infrequent sources that weren't actively logging during chosen search time range.

As far as I can tell, I'm not looking for a "| metadata" search here as that can only give me a list of all sources (no idea which forwarders they actually come from) or a list of hosts (no idea what they are actually logging), not a combination of the two.

[blaise]

Sorry I realise this was asked 5 years ago 🙂
The answers were really useful for me, but for the purpose described in the question and to add a tool to your knowledge,
I like using this command:
| tstats count where host= by index,sourcetype,source

Hope this helps

[kristian_kolb · Accepted solution]

One way, along with what you're already doing is;

 * | stats values(source) by host 

for a reasonable time frame. This can still take some time though, depending on the amount of data you need to search.

Another way is to connect to a given forwarder's splunkd port

https://forwarder:8089/services/admin/inputstatus/TailingProcessor:FileStatus

Note that you'll need the proper credentials for the splunkd on the forwarder in question. (admin/changeme) is the default account on any Splunk installation, but you cannot use the default credentials for remote connections unless you've specifically enabled it.

You could also have a look here, which presents the same info in a slightly nicer form:

http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/

Also, if you use the DeploymentServer, you'll have all the configs there (or you should have)

Hope this helps,

Kristian

[ambujhbti]

Thanks, it helped me!

[Glenn]

The first idea is basically what I ended up doing, but yeah it's still really slow with my 500GB+ daily thruput. The second method (checking the forwarders directly) is a good one, thanks.

It would still be nice for Splunk to be able to report this kind of info easily and quickly within the product though, perhaps I'll raise an enhancement request. Cheers.

[yannK]

Very good answer.

The metadata are not really useful to correlate multiple fields like host and source.

also, if you may want the detail per index too
* | stats values(source) by host index

you could also make a form view for the users to let them search per hosts the list of sources/sourcetype/first and last events