An auditor is requesting that we furnish them with a list of all servers logging to splunk and the index they are being written to. Is there an easy way to do this other then running through the Hosts.data files by hand?
I would run
| metadata index="foo" type=hosts | outputcsv foo_hosts
for each index that could contain host indexed data.
View solution in original post
Thanks.. i figured that one out while you were posting. Splunk Answers--from the keyboard directly to my mind.