Splunk Search

What is the most efficient way to search for unique hosts by a specific index?

I need to find unique hosts consumed by a specific index.
I use the following search string:

index=my_index
|stats values(host)

As I understand, 'values' returns unique values for 'host'. This gives me what I need, but takes a loooooong time (3+ hours).
Is there a better way?

Thanks!

0 Karma
1 Solution

Ultra Champion

Yes, there is a faaar better way;

| metadata type=hosts index=your_index_here

EDIT: and yes. The search actually starts with a pipe.

/K

View solution in original post

Ultra Champion

Yes, there is a faaar better way;

| metadata type=hosts index=your_index_here

EDIT: and yes. The search actually starts with a pipe.

/K

View solution in original post

SplunkTrust
SplunkTrust

metadata is the way to go here, but if your stats requirements on indexed fields become more complex you should take a look at tstats: http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/tstats

For example

| tstats count where index=* by index sourcetype host

Will give you a blazingly fast summary of what your Splunk data looks like in those three dimensions.

Perfect.

Thank you.

0 Karma

Community Manager
Community Manager

I was just about to post that 🙂 Here's the documentation on the metadata command for future reference @victorstarostenko

Cheers!

0 Karma