Splunk Cloud Platform

Searching all hosts in an index for count

verifi81
Path Finder

Hello folks,

I have about 20 hosts that fall under index=devices

I need a query that will display the count information for each host, once over a 24 hour period. 
My intention is to use this to set an alert so that if a host does not have any count in 24 hours, it will send an alert. 

What query would work best for this? 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This will get you the daily counts.

index=devices | bin _time span=1d | stats count by _time host

However, if a host has no events, it will not show up. Ways around this include using lookups to retrieve all the valid hosts from a file or key store, or use a longer time frame to retrieve (and possibly dedup) the hosts so you can see if they had event in the time frame of interest.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This will get you the daily counts.

index=devices | bin _time span=1d | stats count by _time host

However, if a host has no events, it will not show up. Ways around this include using lookups to retrieve all the valid hosts from a file or key store, or use a longer time frame to retrieve (and possibly dedup) the hosts so you can see if they had event in the time frame of interest.

0 Karma
Get Updates on the Splunk Community!

Why getting timeout error while adding data to the Splunk cloud index from REST API?

Hello Team,<BR /><BR />I am getting timeout error while adding data to Splunk cloud index from REST API. I am ...

Is there something different you have to do for a HF-HF-INDEXER than a UF-HF-INDEXER?

My UF-HF-Indexers is working great however I need to add a HF-HF-Indexer as well The first HF sends to other ...

How to write query for including non business hours and weekends

Hi ,I need a query for including non business hours and weekends