List All Hosts Associated with All Indexes _internal SplunkNinja 1 Comment 17 2 Using the Splunk Tstats command you can quickly list all hosts associated with all indexes: |tstats values(host) where index=* by index 1 |tstats values(host) where index=* by index Share This: Tagged: Diagnosticsinternaltroubleshootingtstats
Anon Ymous December 12, 2018 at 3:07 pm Not sure WHY this is, but using the group keyword here chomps results for us. In some cases we are missing hosts. Re-writing the query without it like this: |tstats values(host) where index=* by index gives us more accurate results. Reply
Not sure WHY this is, but using the group keyword here chomps results for us. In some cases we are missing hosts. Re-writing the query without it like this:
|tstats values(host) where index=* by index
gives us more accurate results.