Well, the quickest will probably be:
| metadata type=hosts | where now()-recentTime < (7*24*60*60)
What it actually tells you is which hosts have a most recently sent event whose timestamp is within the last 7 days, though this is likely to be close to what you asked for if you are generally bringing in correctly timestamped data in real time.
Well, the quickest will probably be:
| metadata type=hosts | where now()-recentTime < (7*24*60*60)
What it actually tells you is which hosts have a most recently sent event whose timestamp is within the last 7 days, though this is likely to be close to what you asked for if you are generally bringing in correctly timestamped data in real time.
Yes, this is a much quicker method. Thank you so much.
Does this search do it for you?
index=_internal source="C:\\Program Files\\Splunk\\var\\log\\splunk\\metrics.log" earliest=-7d@d | table sourceHost | dedup sourceHost | stats count
with the source path changed accordingly of course!