Splunk Search

query for a list of hosts


I have a list of 700+ hosts. I need to verify if those hosts have entries in a splunk instance. So I'm just looking to see if those hosts exist in the logs. How can I query all hosts? Thanks.

Tags (1)
0 Karma


try using metadata search

|metadata type=hosts



using this search:

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype, host 
| stats values(index) AS indexes values(sourcetype) AS sourcetype by host

you can list all hosts sending events and you will also get a list of the sourcetype and the index they are sending to.

Hope this helps ...

cheers, MuS

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!