Splunk Search

What is the quickest way to see if a host was ever indexed in Splunk?

Champion

Hi,

What's the quickest way to see if a host was ever indexed in Splunk? I don't want to do an alltime search. Would metadata help?

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

Yes Sir, the metadata command will give you list of hosts which have forwarded/sent data to Splunk along with the last time they sent the data.

|metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time

If you have a list of host you want to validate, like in a lookup table file, then you can join that with these results to see which host is missing.

   |metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time | append [|inputlookup hostlist.csv | table host | eval recentTime="NA"] | stats values(recentTime) as recentTime by host | where mvcount(recentCount)=1 AND recentCount="NA"

View solution in original post

Contributor

Somewhat basing this off somesoni2's answer:

| rest /services/deployment/server/clients splunk_server=local
| eval recentTime="N/A"
| rename instanceName AS host
| append [| metadata type=hosts index=* | where NOT like(host, "%.%")]
| stats values(recentTime) as recentTime by host
| where mvcount(recentTime)=1 AND recentTime="N/A"

This will check for forwarders that are...

  • Phoning home
  • Are not an IP address (could probably use a regex to be more accurate)
  • Haven't sent to any non-internal index

Using a lookup table is nice, but in many cases you have to keep maintaining it. Why not use the forwarder's "table"?

0 Karma

SplunkTrust
SplunkTrust

Yes Sir, the metadata command will give you list of hosts which have forwarded/sent data to Splunk along with the last time they sent the data.

|metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time

If you have a list of host you want to validate, like in a lookup table file, then you can join that with these results to see which host is missing.

   |metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time | append [|inputlookup hostlist.csv | table host | eval recentTime="NA"] | stats values(recentTime) as recentTime by host | where mvcount(recentCount)=1 AND recentCount="NA"

View solution in original post

Champion

Thanks. I'll try to go back and update them. I appreciate the help.

0 Karma

Community Manager
Community Manager

Hi @a212830

I'm glad @somesoni2 answered your question 🙂 Please be sure to accept the correct answers to your questions by clicking on the big check mark next to the answer that solved your issue. This helps other users who have similar questions and can turn to your posts for help and prevents people from asking the same questions over and over. A good number of your previous posts have solutions but you haven't accepted the answers. I can go through them, but it'll be a big help if you could accept correct answers from now on.

Thanks!

Patrick

0 Karma

Champion

fantas-TIC. Thanks.

0 Karma