if you want to know all the hosts you have index data for do a search
index = "*" | stats count by host
Depending on the size of your indexes this query may take a long time to run.
I found the source and it's coming from the /var/log/rhsm/rhsmcertd.log file. Can I just "blacklist" this entry "INFO" to keep it from showing up in the searches? Are there any drawbacks to do this - e.g. missing log files?