I am looking for a good way to show the number of host that are sending log files to splunk over time
I can use timechart but how do I count uniq host names and from what index. I tried _internal for the metrics and summary but when i use uniq or dedup it kills my timchart function.
How to get the number for each day over a 30 day????
I tried this:
index=_internal hostname="*" component="Metrics" | timechart span=d count(uniq hostname)
But that's not right. anyone know the right way??
This will give what you want.
index=_internal per_host_thruput | timechart span=1d dc(series) as hosts
dc is short for distinct count and series contains the host name in the per_host group
View solution in original post