List all reporting devices per Splunk server

[rbruno7]

Hi There,

Here goes my first question.

I need to generate a list of all hosts reporting to each splunk server so I can properly migrate the servers reporting to Splunk-A server to a different Splunk-B instanc on a different data center.

Since most servers don' report every day I need to search on a large timeframe (some report once a week and others once a month).

The first command command that came to my mind is below:

index=company_host OR index=company_network startdaysago=30 | stats distinct_count(host) by splunk_server,host

It does the job but it is incredibly slow and heavy on the Splunk infrastructure.

Is there any magic way to get it done faster without relying on summary indexes?

Best Regards

[gkanapathy · Accepted solution]

Just use:

| metadata type=hosts

Unfortunately, the |metadata command always runs in distributed mode and does not break out results by splunk_server, so you might have to figure out a way to run it in non-distributed mode on each individual server to get the list for each indexer.

You could also just go into the $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ directory (or wherever you keep your indexes hot/warm db) and look in the Hosts.data file on each server, and repeat for each index you're interested in.

[blebit]

great answer

[rbruno7]

This was the magic answer I was looking for!
Thank you!