Splunk Hosts metadata correlation with index

[Mag2sub]

Im using a metadata type=hosts query to output hosts that have not logged data using recenttime
However i dont see the index name being output by this..is there anyway to correlate the host to its index in a query that starts with |metadata type=hosts ?
thanks!

[somesoni2]

This works with Splunk 5 but is on slower side

|eventcount summarize=false index=* | table index | map maxsearches=100 search="|metadata type=hosts  index=$index$ | eval index=\"$index$\""

[Mag2sub]

Its so much on slower side does not look feasible for us...any inputs /modifications to enhance performance appreciated

[martin_mueller]

You could use this to emulate metadata:

| tstats latest(_time) latest(_indextime) count where index=* by host index

[martin_mueller]

metasearch is a different command from metadata.

http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/metasearch

[Mag2sub]

unless i misunderstand when i run metadata type=hosts...index name is not a key value pair returned

is a metadata search not a metasearch ..sorry if i got that wrong

[martin_mueller]

metasearch does output the index.

[Mag2sub]

Thanks ... unless i misundertood something recenttime is indextine for metaseach on hosts ...but metasearch do not output the index names on which they run...i need to be able to read the results to act on it and it needs to have the index name...

[martin_mueller]

Yeah, metasearch with _indextime should be about twice as fast as regular stats... if your forwarders basically send current data then you could get along with using _time as a workaround.

[Ayn]

I've filed an ER for metasearch to output _indextime in results. With that, you could quickly grab these stats.

[martin_mueller]

Anything tstats can do with indexes can be done with stats:

index=* | stats latest(_time) latest(_indextime) count by host index

However, that may be slow, very slow, or glacial. You can of course speed things up by running this query regularly over a short timerange and storing the data in a lookup: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

[Mag2sub]

yes on splunk 5.0.4 unfortunately...is there some way we can do the same ? i just need to find the latest time each host has logged using metadata but also output what index it belongs to ...

[martin_mueller]

This runs against indexes... on Splunk 6. Are you still on version 5?

[Mag2sub]

Hmmm...this throws error expecting a namespace ...tsidxstats error...missing "FROM" keyword to specify namespace
does this work against indexes ? above error suggests it runs only against tsidxstats of tscollect