Splunk Search

Timechart showing if servers are communicating with Splunk

tc641
New Member

Our Splunk expert is away 😮
I want to see the total number servers that can communicate with splunk i.e. they are on the forwarder manager. on the y-axis and time on the x axis.

I have attempted a few searches e.g
| metadata type=hosts
| chart count by recentTime

but this doesn't give me what I want really at all : (

I would appreciate any help.

Thanks 🙂

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

here's one way...

| tstats dc(host) as hostcount WHERE index=_internal by _time span=1h 
| timechart span=1d avg(hostcount)

Here's some other useful ones...

https://answers.splunk.com/answers/294769/how-to-get-a-progressive-chart-of-hosts-added-over.html

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

here's one way...

| tstats dc(host) as hostcount WHERE index=_internal by _time span=1h 
| timechart span=1d avg(hostcount)

Here's some other useful ones...

https://answers.splunk.com/answers/294769/how-to-get-a-progressive-chart-of-hosts-added-over.html

0 Karma

gcusello
Legend

Hi tc641,
to you want to know servers that can communicate with Splunk or servers that are communicating with Splunk?

If the first, you can see all the server in the deployment server or find servers that sent logs in the last (e.g.) one month, running a search like

| metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host 

If instead the second, you should do the following steps:

  1. create a lookup perimeter.csv with one field "host"
  2. populate it with all the servers in your perimeter: manually or scheduling a search lithe this | metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host | outputlookup perimeter.csv
  3. run a search like the following | metasearch index=_internal | host=upper(host) | stats count by host | append [ | inputlookup perimeter.csv | eval count=0, host=upper(host) | fields host count ] | stats sum(count) AS Total by host
  4. In this way servers with Total=0 are missing and Total > 0 are present

Bye.
Giuseppe

0 Karma

gcusello
Legend

Hi tc641,
to you want to know servers that can communicate with Splunk or servers that are communicating with Splunk?

If the first, you can see all the server in the deployment server or find servers that sent logs in the last (e.g.) one month, running a search like

| metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host 

If instead the second, you should do the following steps:

  1. create a lookup perimeter.csv with one field "host"
  2. populate it with all the servers in your perimeter: manually or scheduling a search lithe this | metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host | outputlookup perimeter.csv
  3. run a search like the following | metasearch index=_internal | host=upper(host) | stats count by host | append [ | inputlookup perimeter.csv | eval count=0, host=upper(host) | fields host count ] | stats sum(count) AS Total by host
  4. In this way servers with Total=0 are missing and Total > 0 are present

Bye.
Giuseppe

0 Karma

somesoni2
Revered Legend

This will give you what you want but if you've too many hosts, it won't look pretty.

| metadata type=hosts | table host recentTime | rename recentTime as _time | timechart dc(host) as hosts limit=0

For better suggestion, please describe what you're expect as the output.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...