Splunk Search

Number of hosts forwarding logs to indexer

Explorer

I would like to know the quickest way to count the number of hosts that have sent data to the indexer for the last 7 days.

Tags (3)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Well, the quickest will probably be:

| metadata type=hosts | where now()-recentTime < (7*24*60*60)

What it actually tells you is which hosts have a most recently sent event whose timestamp is within the last 7 days, though this is likely to be close to what you asked for if you are generally bringing in correctly timestamped data in real time.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Well, the quickest will probably be:

| metadata type=hosts | where now()-recentTime < (7*24*60*60)

What it actually tells you is which hosts have a most recently sent event whose timestamp is within the last 7 days, though this is likely to be close to what you asked for if you are generally bringing in correctly timestamped data in real time.

View solution in original post

0 Karma

Explorer

Yes, this is a much quicker method. Thank you so much.

0 Karma

Path Finder

Does this search do it for you?

index=_internal source="C:\\Program Files\\Splunk\\var\\log\\splunk\\metrics.log" earliest=-7d@d | table sourceHost | dedup sourceHost | stats count 

with the source path changed accordingly of course!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!