Our Splunk expert is away 😮
I want to see the total number servers that can communicate with splunk i.e. they are on the forwarder manager. on the y-axis and time on the x axis.
I have attempted a few searches e.g
| metadata type=hosts
| chart count by recentTime
but this doesn't give me what I want really at all : (
I would appreciate any help.
Thanks 🙂
here's one way...
| tstats dc(host) as hostcount WHERE index=_internal by _time span=1h
| timechart span=1d avg(hostcount)
Here's some other useful ones...
https://answers.splunk.com/answers/294769/how-to-get-a-progressive-chart-of-hosts-added-over.html
here's one way...
| tstats dc(host) as hostcount WHERE index=_internal by _time span=1h
| timechart span=1d avg(hostcount)
Here's some other useful ones...
https://answers.splunk.com/answers/294769/how-to-get-a-progressive-chart-of-hosts-added-over.html
Hi tc641,
to you want to know servers that can communicate with Splunk or servers that are communicating with Splunk?
If the first, you can see all the server in the deployment server or find servers that sent logs in the last (e.g.) one month, running a search like
| metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host
If instead the second, you should do the following steps:
perimeter.csv
with one field "host"| metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host | outputlookup perimeter.csv
| metasearch index=_internal | host=upper(host) | stats count by host | append [ | inputlookup perimeter.csv | eval count=0, host=upper(host) | fields host count ] | stats sum(count) AS Total by host
Bye.
Giuseppe
Hi tc641,
to you want to know servers that can communicate with Splunk or servers that are communicating with Splunk?
If the first, you can see all the server in the deployment server or find servers that sent logs in the last (e.g.) one month, running a search like
| metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host
If instead the second, you should do the following steps:
perimeter.csv
with one field "host"| metasearch index=_internal earliest=-1mon latest=now | dedup host | sort host | table host | outputlookup perimeter.csv
| metasearch index=_internal | host=upper(host) | stats count by host | append [ | inputlookup perimeter.csv | eval count=0, host=upper(host) | fields host count ] | stats sum(count) AS Total by host
Bye.
Giuseppe
This will give you what you want but if you've too many hosts, it won't look pretty.
| metadata type=hosts | table host recentTime | rename recentTime as _time | timechart dc(host) as hosts limit=0
For better suggestion, please describe what you're expect as the output.