fast query to output hosts not logging to index

[Mag2sub]

On 5.0.4 ...appreciate suggestions on performance conducive query to output hosts not logging to index with index names also being output in the search results
We have huge amounts of data and would need the query to be as fast as possible ..possibly run ove r a 1 hour interval

Appreciate!

[martin_mueller]

Have you tried my suggestion of incrementally building a lookup with all your hosts? As a result you'll only need to look through e.g. an hour of data every hour. Each query should be fast, no need to look at data twice to find a previously-sending host that has just stopped.

[Mag2sub]

Apologies ...I guess the other was specific on query to correlate...and im still stuck with the question of a fast query for above as we TB of data .i need both index names and hosts not logging to be output in same query result and a fast query at that ... as we have gobs of data ...i do not want the query to be stuck with a high cost

[martin_mueller]

Isn't this basically a duplicate of http://answers.splunk.com/answers/143539/splunk-hosts-metadata-correlation-with-index?

[linu1988]

Did you try

|metadata type=hosts index=*

This is the fastest way to get the host names.

OR

if you want it to be index independent, make a summary index and start collecting them. Search them over time.

Thanks,
L

[Mag2sub]

I have tried that before Above query does not output index names in search result...so its not helpful

Thanks