Splunk Search

How to write a serach to list hosts sending data being indexed in Splunk for a specific sourcetype?

DomenicoFumarol
Explorer

Hello,

I'm trying to build a search that lists the hosts daily that are, filtering for a specific SourceType, sending data being indexed in Splunk.
Sort of a daily "Top Talkers" for a specific SourceType.

Appreciated any help.

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I guess you're trying to make a custom license dashboard?

By default, there should be a search called License Usage Data Cube in your search app. If not, it's this search:

index=_internal source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx

Accelerate that search using report acceleration and an appropriate time range, e.g. 30 days. Once the acceleration has completed, add the saved search to your dashboard as a base search and display your data with a postprocessing search something like this:

| search st=$st$ | timechart span=1d sum(b) by h

That's assuming st is a token from a dropdown selecting the sourcetype to filter by.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I guess you're trying to make a custom license dashboard?

By default, there should be a search called License Usage Data Cube in your search app. If not, it's this search:

index=_internal source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx

Accelerate that search using report acceleration and an appropriate time range, e.g. 30 days. Once the acceleration has completed, add the saved search to your dashboard as a base search and display your data with a postprocessing search something like this:

| search st=$st$ | timechart span=1d sum(b) by h

That's assuming st is a token from a dropdown selecting the sourcetype to filter by.

lguinn2
Legend

You can do this, which will run very quickly:

| tstats count where index=* sourcetype=X by host
| sort 0 -count

If you only want to see the top 10 or top 20, replace the zero in the sort command with the number of hosts you would like to see in the results. Note that this is counting the number of events, not the size of the events. So which this may be correlated with license usage, it will be not match. For information on license usage by sourcetype, take a look at the Distributed Monitoring Console (called just the Monitoring Console starting in Splunk 6.5)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...