| tstats count where index=_* OR index=* by host,index
| stats values(index) as index dc(index) as distinct_count by host
| sort - distinct_count
Hi @AK007,
to know the indexes where logs are stored you can run a simple search:
| metasearch index=*
| stats values(index) AS index count BY host
if you want also internal indexes:
| metasearch index=* OR index=_*
| stats values(index) AS index count BY host
In addition, if you want to check if all the UFs are sending logs, you can insert the UFs to monitor in a lookup and run a search like this:
| metasearch index=* OR index=_*
| eval host=lower(host)
| stats values(index) AS index count BY host
| append [ | inputlookup my_lookup | eval host=lower(host), count=0 | fields count host ]
| stats values(index) AS index sum(count) AS total BY host
in this way, the hosts with total=0 aren't sending logs and they are missed.
Ciao.
Giuseppe