Monitoring Splunk

What is the command to check the list of all servers or IP Address which Splunk is monitoring currently?

phanichintha
Path Finder

Command or Solution to get the list of IP Address or servers list or Hostnames, which are Splunk is monitoring currently.

Tags (1)
0 Karma
1 Solution

koshyk
Super Champion

To see where what you are collecting data from (extend this to 7 days or something)

|tstats latest(_time) as latest_indexed WHERE index=* by host

If you have monitoring Console, you can get list of all Splunk Forwarders (UF & HF etc) to get the list. This should be run on system which have MC/DMC working.

| inputlookup dmc_forwarder_assets

cheers

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @phanichintha,

Your question is similar to this one :
https://answers.splunk.com/answers/747065/how-to-set-up-an-alert-when-an-server-goes-down-or.html

So you can simply run this command and it will give you the list of servers that sent logs in the last 10 minutes :

 |metadata type=hosts index=_* index=*
 |where now()-lastTime > 600

Run it over all time to get the whole list of servers. This runs on metadata so you should get your results almost instantly even if you use all time.

Cheers,
David

0 Karma

koshyk
Super Champion

To see where what you are collecting data from (extend this to 7 days or something)

|tstats latest(_time) as latest_indexed WHERE index=* by host

If you have monitoring Console, you can get list of all Splunk Forwarders (UF & HF etc) to get the list. This should be run on system which have MC/DMC working.

| inputlookup dmc_forwarder_assets

cheers

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...