I have a list of 700+ hosts. I need to verify if those hosts have entries in a splunk instance. So I'm just looking to see if those hosts exist in the logs. How can I query all hosts? Thanks.
try using metadata search
using this search:
| tstats count WHERE index=* OR sourcetype=* by index,sourcetype, host
| stats values(index) AS indexes values(sourcetype) AS sourcetype by host
you can list all hosts sending events and you will also get a list of the sourcetype and the index they are sending to.
Hope this helps ...