Splunk Search

List of host from Syslog-ng server.

arjit
Path Finder

Hi Team 

I could see my license limit has reached for my syslog-ng. Can you please let me know how can I get a list of all the host which are getting data from syslog via syslog-ng to splunk? 

Thanks,

AG. 

0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @arjit,

I think your are getting data from syslog-ng by file monitor. If you are not overwriting source field, you can use it as a filter.

Let's say your syslog data creates file in /var/log/splunk/syslog/...

|tstats count where index=* source="/var/log/splunnk/syslog*" by host 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

arjit
Path Finder

@scelikok  Thanks Scelikok! it helped. 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @arjit,

I think your are getting data from syslog-ng by file monitor. If you are not overwriting source field, you can use it as a filter.

Let's say your syslog data creates file in /var/log/splunk/syslog/...

|tstats count where index=* source="/var/log/splunnk/syslog*" by host 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...