Splunk Search

How to search for a list of hosts and the count of events that have been indexed per day for each host?

dolejh76
Communicator

I am sure that this has been asked and answered but I cant find a format that gives me what I am looking for.

I would like to get a list of hosts and the count of events per day from that host that have been indexed. Essentially I would like to take this to management and show ROI that looks at the millions of events each day from these hosts that have been indexed.

So it would show

Hosts 12/1 12/2 12/3 12/4 (last 7 or 30 days)
Host1 xxxx xxxx xxxx xxxx
Host 2 xxxx xxxx xxxx xxxx
Firewall xxxx xxxx xxxx xxxx
etc

xxxx = number of events indexed

Any help is appreciated - thanks

Tags (4)
0 Karma
1 Solution

MuS
Legend

Hi dolejh76,

try something like this:

your base search here | timechart span=1d count by host

hope it helps ...

cheers, MuS

View solution in original post

yannK
Splunk Employee
Splunk Employee

If you prefer the other way, (date at columns, rows as hosts )

< mysearch >  | bucket _time span=1d  
|convert ctime(_time) AS date timeformat="%Y/%m/%d" 
| chart count over host by date

MuS
Legend

Hi dolejh76,

try something like this:

your base search here | timechart span=1d count by host

hope it helps ...

cheers, MuS

dolejh76
Communicator

That helped thanks - one more for you - what about size in KB for the same data? This way I can show how much of our license each host is chewing up per day?

Thanks
John

0 Karma

MuS
Legend

Sure, on your license master search the internal index for the source license_usage.log like this:

index=_internal source="*license_usage.log" | timechart span=1d sum(eval(b/1024)) AS KB by h | rename h AS host

cheers, MuS

dolejh76
Communicator

I like this report - unfortunately... there is a NULL field that has a considerable amount of data usage? Any idea what that would be? At this point we are ONLY pulling in wineventlogs and AD data - so it shouldn't be this high...

Looks like there is an "OTHER" Field as well.... so what is "OTHER" and "NULL"

Thanks
JD

0 Karma

MuS
Legend
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...