Splunk Search

List of host from Syslog-ng server.

arjit
Path Finder

Hi Team 

I could see my license limit has reached for my syslog-ng. Can you please let me know how can I get a list of all the host which are getting data from syslog via syslog-ng to splunk? 

Thanks,

AG. 

0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @arjit,

I think your are getting data from syslog-ng by file monitor. If you are not overwriting source field, you can use it as a filter.

Let's say your syslog data creates file in /var/log/splunk/syslog/...

|tstats count where index=* source="/var/log/splunnk/syslog*" by host 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

arjit
Path Finder

@scelikok  Thanks Scelikok! it helped. 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @arjit,

I think your are getting data from syslog-ng by file monitor. If you are not overwriting source field, you can use it as a filter.

Let's say your syslog data creates file in /var/log/splunk/syslog/...

|tstats count where index=* source="/var/log/splunnk/syslog*" by host 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...