Active computers reporting to splunk last 30 days

[cyler]

I would like to know how to search for all computers that are reporting to Splunk in the last 30 day.

Thank you

[cyler]

Forgive my being naive - Here is what result I get back

[DalJeanis]

get rid of everything before the first pipe

[elliotproebstel]

You could try these:

| tstats latest(_time) AS latest where index=* by host

or
| metadata type=hosts
Either should work.

[adonio]

many ways to go about it ...
try this |metadata type=hosts
see the output of the command and start exploring ...
heres a link to the doc that has more elaborated examples:
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Metadata
hope it helps

[cyler]

index=my_index* | metadata type=hosts

Error in 'metadata' command: This command must be the first command of a search.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

[adonio]

please read the doc
metadata is a generating command has to be first
no need for index = something before
place this in your searchbae literally |metadata type=hosts

[skulk]

Hi,

You should ru search like this one (set time-range picker for last 30 days):

index=* | stats count by host

This search will show you all hosts and number of events from each other.