Ad slot: top

SPL

List All Hosts Associated with All Indexes

Description

Submitted by SplunkNinja

Using the Splunk Tstats command you can quickly list all hosts associated with all indexes:
21 2
|tstats values(host) where index=* by index

Comments

1 total

AN
Anon Ymous
12/12/2018

Not sure WHY this is, but using the group keyword here chomps results for us. In some cases we are missing hosts. Re-writing the query without it like this:\r\n\r\n |tstats values(host) where index=* by index \r\n\r\ngives us more accurate results.

Leave a comment

You must log in to post a comment.

Ad slot: bottom