query for a list of hosts

[DTERM]

I have a list of 700+ hosts. I need to verify if those hosts have entries in a splunk instance. So I'm just looking to see if those hosts exist in the logs. How can I query all hosts? Thanks.

[sfatnass]

try using metadata search

|metadata type=hosts

[MuS]

Hi DTERM,

using this search:

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype, host 
| stats values(index) AS indexes values(sourcetype) AS sourcetype by host

you can list all hosts sending events and you will also get a list of the sourcetype and the index they are sending to.

Hope this helps ...

cheers, MuS