You're better off running this:
| metadata type=hosts index=*
Will run over all time in no time.
Thanks a lot....
I downvoted this post because it's not an answer
if you want to know all the hosts you have index data for do a search
index = "*" | stats count by host
Depending on the size of your indexes this query may take a long time to run.
I am seeing INFO in the list of hosts but I don't see where that is coming from. What does it mean and where is it coming from?
I found the source and it's coming from the /var/log/rhsm/rhsmcertd.log file. Can I just "blacklist" this entry "INFO" to keep it from showing up in the searches? Are there any drawbacks to do this - e.g. missing log files?