Splunk Search

Timechart showing if servers are communicating with Splunk

tc641
New Member

Our Splunk expert is away 😮
I want to see the total number servers that can communicate with splunk i.e. they are on the forwarder manager. on the y-axis and time on the x axis.

I have attempted a few searches e.g
| metadata type=hosts
| chart count by recentTime

but this doesn't give me what I want really at all : (

I would appreciate any help.

Thanks 🙂

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

here's one way...

| tstats dc(host) as hostcount WHERE index=_internal by _time span=1h 
| timechart span=1d avg(hostcount)

Here's some other useful ones...

https://answers.splunk.com/answers/294769/how-to-get-a-progressive-chart-of-hosts-added-over.html

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

here's one way...

| tstats dc(host) as hostcount WHERE index=_internal by _time span=1h 
| timechart span=1d avg(hostcount)

Here's some other useful ones...

https://answers.splunk.com/answers/294769/how-to-get-a-progressive-chart-of-hosts-added-over.html

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi tc641,
to you want to know servers that can communicate with Splunk or servers that are communicating with Splunk?

If the first, you can see all the server in the deployment server or find servers that sent logs in the last (e.g.) one month, running a search like

| metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host 

If instead the second, you should do the following steps:

  1. create a lookup perimeter.csv with one field "host"
  2. populate it with all the servers in your perimeter: manually or scheduling a search lithe this | metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host | outputlookup perimeter.csv
  3. run a search like the following | metasearch index=_internal | host=upper(host) | stats count by host | append [ | inputlookup perimeter.csv | eval count=0, host=upper(host) | fields host count ] | stats sum(count) AS Total by host
  4. In this way servers with Total=0 are missing and Total > 0 are present

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi tc641,
to you want to know servers that can communicate with Splunk or servers that are communicating with Splunk?

If the first, you can see all the server in the deployment server or find servers that sent logs in the last (e.g.) one month, running a search like

| metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host 

If instead the second, you should do the following steps:

  1. create a lookup perimeter.csv with one field "host"
  2. populate it with all the servers in your perimeter: manually or scheduling a search lithe this | metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host | outputlookup perimeter.csv
  3. run a search like the following | metasearch index=_internal | host=upper(host) | stats count by host | append [ | inputlookup perimeter.csv | eval count=0, host=upper(host) | fields host count ] | stats sum(count) AS Total by host
  4. In this way servers with Total=0 are missing and Total > 0 are present

Bye.
Giuseppe

0 Karma

somesoni2
Revered Legend

This will give you what you want but if you've too many hosts, it won't look pretty.

| metadata type=hosts | table host recentTime | rename recentTime as _time | timechart dc(host) as hosts limit=0

For better suggestion, please describe what you're expect as the output.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!