Splunk Search

List of host from Syslog-ng server.

arjit
Path Finder

Hi Team 

I could see my license limit has reached for my syslog-ng. Can you please let me know how can I get a list of all the host which are getting data from syslog via syslog-ng to splunk? 

Thanks,

AG. 

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi @arjit,

I think your are getting data from syslog-ng by file monitor. If you are not overwriting source field, you can use it as a filter.

Let's say your syslog data creates file in /var/log/splunk/syslog/...

|tstats count where index=* source="/var/log/splunnk/syslog*" by host 

 

If this reply helps you an upvote is appreciated.

View solution in original post

arjit
Path Finder

@scelikok  Thanks Scelikok! it helped. 

0 Karma

scelikok
Champion

Hi @arjit,

I think your are getting data from syslog-ng by file monitor. If you are not overwriting source field, you can use it as a filter.

Let's say your syslog data creates file in /var/log/splunk/syslog/...

|tstats count where index=* source="/var/log/splunnk/syslog*" by host 

 

If this reply helps you an upvote is appreciated.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.