Splunk Search

How to check if a host ever reported to Splunk

SamHTexas
Builder

How to check if a couple of hosts /VMs ever reported to Splunk? I have looked in Deployment server, no sign of them or history. Please advise

Labels (1)
Tags (1)
0 Karma

Vardhan
Contributor

Hi @SamHTexas ,

Check the internal logs of those hosts using the below query. If the host had reported past and stopped reporting now you can find out when the host has sent the last log.

index=_internal host= spl01* (mention the hostname*) 

or

|tstats count where index=_internal host=spl01* by host ( use this query if you want to check more than 30days)

if this answer helps you then upvote it.

0 Karma

SamHTexas
Builder

index=_internal host= spl01* (mention the hostname*)

In the above I just write it in capital letters to see if I have it. Is it host=SPL01*   correct?

Also I don't have access to the hosts, they are VMs in another city. Please advise.

Tags (1)
0 Karma

Vardhan
Contributor

HI @SamHTexas ,

 

You have to mention your hostname. I just mentioned that as an example. And without having list of hostnames how will you check? you need to get that information.

And if you need just the host information which are reporting to Splunk. You use the below query.

| tstats count where index=_internal  by host  (it will give all the hosts list)

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>