SPL
List All Hosts Associated with All Indexes
Description
Using the Splunk Tstats command you can quickly list all hosts associated with all indexes:
21 2
|tstats values(host) where index=* by index
SPL
|tstats values(host) where index=* by index
Comments
1 total
Not sure WHY this is, but using the group keyword here chomps results for us. In some cases we are missing hosts. Re-writing the query without it like this:\r\n\r\n |tstats values(host) where index=* by index \r\n\r\ngives us more accurate results.
Leave a comment
You must log in to post a comment.