Splunk Enterprise

Is there a Central place I can look to find the entire list of Servers, resources Reporting in to Splunk ?

SamHTexas
Builder

I have Splunk Enterprise + ES. We initially targeted a long list of servers on Premise & on the Cloud to report into Splunk & ES. I need to take an inventory of all Servers & regions making sure I am watching the "entire" herd. How do I accomplish this please? Thank u in advance

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here are two quick queries to show which servers are sending data to Splunk.

| tstats count where index=* by host | fields - count
| metadata type=hosts index=*

Both queries will show the servers that are reporting to Splunk, but cannot show those that are not.  Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!