newbe question: How do I list machines reporting to my splunk server?

[jawehren]

How do I list machines reporting to my server?

[ftk]

This search will give you all hosts reporting to your indexer and the last time they forwarded data.

| metadata type=hosts index=foo | eval last_contact=now()-recentTime

[muebel]

Here are a couple searches that will get a list of hosts. This one will give you all machines in last 10 minutes reporting in:

* minutesago=10 | dedup host | stats list(host)

you can run this over any time frame you want... minutesago=30? Or, you can use the time picker and select "custom time" to look at all host reporting in during the time frame of your choice.

Here is another search that gives you all hosts reporting in, but also the number of events from each host:

* minutesago=10 | chart count(host) by host

The above search will give you each host reporting in during last 10 minutes, and also the number of events from that host. Lets you see who is most active.

[southeringtonp]

Run the following search:

| metadata hosts