list of hosts for a given time range

[MBerikcurtis]

I'm sure there is a better way. I'm trying to get a list of hosts for a given time range. The search I'm using now is

host=* | table host

this can take a long time to run dependent on the time range I'm looking at.

[_d_ · Accepted solution]

You can use either of these, depending on what you'd like displayed:

| metadata type=hosts | table host

OR

| metadata type=hosts | stats count by host

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!