Splunk Search

query for a list of hosts

DTERM
Contributor

I have a list of 700+ hosts. I need to verify if those hosts have entries in a splunk instance. So I'm just looking to see if those hosts exist in the logs. How can I query all hosts? Thanks.

Tags (1)
0 Karma

sfatnass
Contributor

try using metadata search

|metadata type=hosts

MuS
Legend

Hi DTERM,

using this search:

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype, host 
| stats values(index) AS indexes values(sourcetype) AS sourcetype by host

you can list all hosts sending events and you will also get a list of the sourcetype and the index they are sending to.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...