Splunk Search

Find out index of hosts sending new since 24hrs

lslschr21
Loves-to-Learn Lots

Hi
I wanted to write a search that show all hosts that sends new since 24hrs into Splunk. The problem now is that I want to see in which index, these hosts deliver. For the first part I wrote the following search.

 

| metadata type=hosts index=_* OR index=*
| where firstTime >= relative_time(now(), "-24h")
| convert timeformat="%Y-%m-%d %T" ctime(firstTime) as firstTime, ctime(lastTime) as lastTime, ctime(recentTime) as recentTime
| search host!="*_*"
| table host, firstTime, recentTime
| join [|tstats latest(_time) as firsttwoTime where (index=* OR index=_*) by host, index
| table index, host]
| table index, host, firstTime, recentTime

 

The problem now is that this search is really slow, is there any other search that would be more efficient?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...