Monitoring Splunk

host in metadata but has no logs

reswob4
Builder

I have a search that starts off with

| metadata type=hosts ....

The problem is that the results are pulling back a host that is not sending logs or should be sending logs. A search for the host in Splunk turns up nothing.

So my question is why it's showing up in metadata if no logs are being collected (or have ever been collected) from that host?

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi reswob4,

there could be multiple reasons for this:

  1. Host has been renamed
  2. Wrong timestamp recognition and the events are way in the past or future
  3. Someone used the delete command for this host which makes events not searchable but they are still in your index and therefore in the metadata.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi reswob4,

there could be multiple reasons for this:

  1. Host has been renamed
  2. Wrong timestamp recognition and the events are way in the past or future
  3. Someone used the delete command for this host which makes events not searchable but they are still in your index and therefore in the metadata.

Hope this helps ...

cheers, MuS

reswob4
Builder

Thanks.

I'm going to mark this as answered, but if anyone else has suggestions, that would be much appreciated.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...