Get list of VM's from splunk

[vj5]

Is there a way to get the list of VM's which is forwarding data to the Splunk ?

[fferozbasha]

index=_internal sourcetype=splunkd host= group=per_host_thruput | fields series | stats values(series) as hosts

[renjith_nair]

Try

|metadata type=hosts|table host

[fferozbasha]

this will list out NOT just the hosts sending data BUT also our own host details such as Search head, indexers, Heavy weight forwarders

[renjith_nair]

If you need specifically UFs, then you could use below but the search will be slow.

index="_internal" source="*metrics.log*" group=tcpin_connections  fwdType=uf |stats count by hostname|fields - count

[adonio]

sure,
how does these vms send data to splunk?
try this:
| tstats max(_time) as last_event where index=* by host
that will give you the last time (in epoch) a host (maybe a vm) reported to splunk