Splunk Search

query for a list of hosts

DTERM
Contributor

I have a list of 700+ hosts. I need to verify if those hosts have entries in a splunk instance. So I'm just looking to see if those hosts exist in the logs. How can I query all hosts? Thanks.

Tags (1)
0 Karma

sfatnass
Contributor

try using metadata search

|metadata type=hosts

MuS
SplunkTrust
SplunkTrust

Hi DTERM,

using this search:

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype, host 
| stats values(index) AS indexes values(sourcetype) AS sourcetype by host

you can list all hosts sending events and you will also get a list of the sourcetype and the index they are sending to.

Hope this helps ...

cheers, MuS

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!