SPL
Total Number of Hosts reporting in.
Description
This query will list the total number of hosts reporting to the indexer for any specified time range.
This only works for universal forwarders. If you have hosts reporting in over syslog (typically port 514) they will not be listed.
1 0
index=_internal sourcetype=splunkd | stats dc(hostname) as "Number of Hosts"
Comments
1 total
The same splunk result can be achieved other splunk commands as listed in http://www.cloudibee.com/splunk-search-cheatsheet/.\r\n\r\nExample : List all hosts that are logging to a particular index. In this example ,we use apachelog as the index.\r\n\r\nindex=apachelog| table host | dedup host\r\nindex=apachelog | stats count by host\r\n\r\nHope this helps and you can add it here too.
Leave a comment
You must log in to post a comment.