I have Splunk Enterprise + ES. We initially targeted a long list of servers on Premise & on the Cloud to report into Splunk & ES. I need to take an inventory of all Servers & regions making sure I am watching the "entire" herd. How do I accomplish this please? Thank u in advance
Here are two quick queries to show which servers are sending data to Splunk.
| tstats count where index=* by host | fields - count
| metadata type=hosts index=*
Both queries will show the servers that are reporting to Splunk, but cannot show those that are not. Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.