Splunk Enterprise

Is there a Central place I can look to find the entire list of Servers, resources Reporting in to Splunk ?

SamHTexas
Builder

I have Splunk Enterprise + ES. We initially targeted a long list of servers on Premise & on the Cloud to report into Splunk & ES. I need to take an inventory of all Servers & regions making sure I am watching the "entire" herd. How do I accomplish this please? Thank u in advance

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here are two quick queries to show which servers are sending data to Splunk.

| tstats count where index=* by host | fields - count
| metadata type=hosts index=*

Both queries will show the servers that are reporting to Splunk, but cannot show those that are not.  Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...