Splunk Search

Query to find servers reporting to splunk

Ravan
Path Finder

Need a query to find list of servers reporting to splunk, and send that output to a lookupfile.

Tags (1)
0 Karma
1 Solution

johandk
Path Finder

If it is the hosts(sources) sending data to your Splunk instance that you are interested in, this might work for you:

|metadata type=hosts | fields host, firstTime, lastTime, totalCount | eval firstTime=strftime(firstTime, "%Y-%m-%d %H:%M:%S") | eval lastTime=strftime(lastTime, "%Y-%m-%d %H:%M:%S") | sort -totalCount | outputlookup meta_data_hosts.csv

View solution in original post

johandk
Path Finder

If it is the hosts(sources) sending data to your Splunk instance that you are interested in, this might work for you:

|metadata type=hosts | fields host, firstTime, lastTime, totalCount | eval firstTime=strftime(firstTime, "%Y-%m-%d %H:%M:%S") | eval lastTime=strftime(lastTime, "%Y-%m-%d %H:%M:%S") | sort -totalCount | outputlookup meta_data_hosts.csv

Ravan
Path Finder

Above Query working fine , but in few results i found reporting date's as 2013/14 year ... Is it problem from splunk server OR clients end ..?

0 Karma

Damien_Dallimor
Ultra Champion

Have a look at the outputlookup search command :

http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Outputlookup

When you say servers reporting to Splunk , do you mean a list of Splunk components(forwarders, indexers, search heads etc..) or do you mean the hostname/IP from all sources of data that is indexed in Splunk ?

Ravan
Path Finder

In this case it is forwarders reporting to splunk

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...