Splunk Search

List of host from Syslog-ng server.

arjit
Path Finder

Hi Team 

I could see my license limit has reached for my syslog-ng. Can you please let me know how can I get a list of all the host which are getting data from syslog via syslog-ng to splunk? 

Thanks,

AG. 

0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @arjit,

I think your are getting data from syslog-ng by file monitor. If you are not overwriting source field, you can use it as a filter.

Let's say your syslog data creates file in /var/log/splunk/syslog/...

|tstats count where index=* source="/var/log/splunnk/syslog*" by host 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

arjit
Path Finder

@scelikok  Thanks Scelikok! it helped. 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @arjit,

I think your are getting data from syslog-ng by file monitor. If you are not overwriting source field, you can use it as a filter.

Let's say your syslog data creates file in /var/log/splunk/syslog/...

|tstats count where index=* source="/var/log/splunnk/syslog*" by host 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...