Hi
I wanted to write a search that show all hosts that sends new since 24hrs into Splunk. The problem now is that I want to see in which index, these hosts deliver. For the first part I wrote the following search.
| metadata type=hosts index=_* OR index=*
| where firstTime >= relative_time(now(), "-24h")
| convert timeformat="%Y-%m-%d %T" ctime(firstTime) as firstTime, ctime(lastTime) as lastTime, ctime(recentTime) as recentTime
| search host!="*_*"
| table host, firstTime, recentTime
| join [|tstats latest(_time) as firsttwoTime where (index=* OR index=_*) by host, index
| table index, host]
| table index, host, firstTime, recentTime
The problem now is that this search is really slow, is there any other search that would be more efficient?
