How to list servers sending logs to Splunk along with source & sourcetype details

[splunkwar]

Hi,

I need to list all the Source Server Details (Hosname and IP Address) including log paths & Log File names which are sending logs to Splunk environment. The following query doesn't fetch the IP Address. Is there any better way to do it?

index=* 
| stats values(source) as sources ,values(sourcetype) as sourcetype by host

[sumanssah · Accepted solution]

Try below mentioned SPL, work normally if you are not on Splunk cloud environment. Please check and let us know if works

| tstats  values(source) as sources ,values(sourcetype) as sourcetype where index=* by host
| lookup dnslookup clienthost as host OUTPUT  clientip as src_ip

[splunkwar]

Hey mate, Thanks for your answer. Do I need to make any changes on | lookup query part. pardon for basic doubt, I am new to Splunk.

[sumanssah]

Hello @splunkwar , its internet lookup script. No changes required 🙂

[splunkwar]

Thanks @sumanssah . It perfectly worked and fulfilled my need.

[manjunathmeti]

Check this query. In results host might contain IPs, hostname or just names of the source. You need to map host values with IPs using a csv lookup.

| metasearch index=*
| stats count by index,source,host,sourcetype

[splunkwar]

Thanks for your answer !

[richgalloway]

Do you have a lookup table that maps host names to IP addresses?