@DalJeanis,
Thank you very much. Your solutions worked for my ad-hoc report and long term report (both small number of servers and large number of servers)!! However, I do noted that the timechart has a limit of 10 servers only in the line chart, I used this to show all servers in the line chart:
| timechart span=1d sum(daycount) by host useother=f limit=0
Anyway, it looks very messy in the line chart as I have 3000+ servers to display, so I decided to filter according to server role in my inventory list and export it to Excel spreadsheet and do a pivot to show my manager server count based on the last ingested time grouped into day (for specific server roles only, which I can change it according to which server role he wants to look at). My final solution is as below.
index=zzz [
| inputlookup ServerInventory.csv
| search Status="Active" Server_Role="Web"
| fields ServerName
| rename ServerName as host
]
| append [
inputlookup append=t ServerInventory.csv
| search Status="Active" Server_Role="Web"
| fields ServerName
| rename ServerName as host
| addinfo
| eval _time = min_time_info
| table _time host
]
| stats max(_time) as _time by host
... View more
