What is the quickest way to see if a host was ever indexed in Splunk?

[a212830]

Hi,

What's the quickest way to see if a host was ever indexed in Splunk? I don't want to do an alltime search. Would metadata help?

[tmontney]

Somewhat basing this off somesoni2's answer:

| rest /services/deployment/server/clients splunk_server=local
| eval recentTime="N/A"
| rename instanceName AS host
| append [| metadata type=hosts index=* | where NOT like(host, "%.%")]
| stats values(recentTime) as recentTime by host
| where mvcount(recentTime)=1 AND recentTime="N/A"

This will check for forwarders that are...

• Phoning home
• Are not an IP address (could probably use a regex to be more accurate)
• Haven't sent to any non-internal index

Using a lookup table is nice, but in many cases you have to keep maintaining it. Why not use the forwarder's "table"?

[somesoni2 · Accepted solution]

Yes Sir, the metadata command will give you list of hosts which have forwarded/sent data to Splunk along with the last time they sent the data.

|metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time

If you have a list of host you want to validate, like in a lookup table file, then you can join that with these results to see which host is missing.

   |metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time | append [|inputlookup hostlist.csv | table host | eval recentTime="NA"] | stats values(recentTime) as recentTime by host | where mvcount(recentCount)=1 AND recentCount="NA"

[a212830]

Thanks. I'll try to go back and update them. I appreciate the help.

[ppablo]

Hi @a212830

I'm glad @somesoni2 answered your question 🙂 Please be sure to accept the correct answers to your questions by clicking on the big check mark next to the answer that solved your issue. This helps other users who have similar questions and can turn to your posts for help and prevents people from asking the same questions over and over. A good number of your previous posts have solutions but you haven't accepted the answers. I can go through them, but it'll be a big help if you could accept correct answers from now on.

Thanks!

Patrick

[a212830]

fantas-TIC. Thanks.