How to search for a list of hosts and the count of events that have been indexed per day for each host?

[dolejh76]

I am sure that this has been asked and answered but I cant find a format that gives me what I am looking for.

I would like to get a list of hosts and the count of events per day from that host that have been indexed. Essentially I would like to take this to management and show ROI that looks at the millions of events each day from these hosts that have been indexed.

So it would show

Hosts 12/1 12/2 12/3 12/4 (last 7 or 30 days)
Host1 xxxx xxxx xxxx xxxx
Host 2 xxxx xxxx xxxx xxxx
Firewall xxxx xxxx xxxx xxxx
etc

xxxx = number of events indexed

Any help is appreciated - thanks

[yannK]

If you prefer the other way, (date at columns, rows as hosts )

< mysearch >  | bucket _time span=1d  
|convert ctime(_time) AS date timeformat="%Y/%m/%d" 
| chart count over host by date

[MuS · Accepted solution]

Hi dolejh76,

try something like this:

your base search here | timechart span=1d count by host

hope it helps ...

cheers, MuS

[dolejh76]

That helped thanks - one more for you - what about size in KB for the same data? This way I can show how much of our license each host is chewing up per day?

Thanks
John

[MuS]

Sure, on your license master search the internal index for the source license_usage.log like this:

index=_internal source="*license_usage.log" | timechart span=1d sum(eval(b/1024)) AS KB by h | rename h AS host

cheers, MuS

[dolejh76]

I like this report - unfortunately... there is a NULL field that has a considerable amount of data usage? Any idea what that would be? At this point we are ONLY pulling in wineventlogs and AD data - so it shouldn't be this high...

Looks like there is an "OTHER" Field as well.... so what is "OTHER" and "NULL"

Thanks
JD

[MuS]

see the docs about timechart tc options http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Timechart#tc_options