Splunk Search

query for a list of hosts

DTERM
Contributor

I have a list of 700+ hosts. I need to verify if those hosts have entries in a splunk instance. So I'm just looking to see if those hosts exist in the logs. How can I query all hosts? Thanks.

Tags (1)
0 Karma

sfatnass
Contributor

try using metadata search

|metadata type=hosts

MuS
Legend

Hi DTERM,

using this search:

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype, host 
| stats values(index) AS indexes values(sourcetype) AS sourcetype by host

you can list all hosts sending events and you will also get a list of the sourcetype and the index they are sending to.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...