Splunk Search

How to check if a host ever reported to Splunk

SamHTexas
Builder

How to check if a couple of hosts /VMs ever reported to Splunk? I have looked in Deployment server, no sign of them or history. Please advise

Labels (1)
Tags (1)
0 Karma

Vardhan
Contributor

Hi @SamHTexas ,

Check the internal logs of those hosts using the below query. If the host had reported past and stopped reporting now you can find out when the host has sent the last log.

index=_internal host= spl01* (mention the hostname*) 

or

|tstats count where index=_internal host=spl01* by host ( use this query if you want to check more than 30days)

if this answer helps you then upvote it.

0 Karma

SamHTexas
Builder

index=_internal host= spl01* (mention the hostname*)

In the above I just write it in capital letters to see if I have it. Is it host=SPL01*   correct?

Also I don't have access to the hosts, they are VMs in another city. Please advise.

Tags (1)
0 Karma

Vardhan
Contributor

HI @SamHTexas ,

 

You have to mention your hostname. I just mentioned that as an example. And without having list of hostnames how will you check? you need to get that information.

And if you need just the host information which are reporting to Splunk. You use the below query.

| tstats count where index=_internal  by host  (it will give all the hosts list)

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...