Reporting

List all reporting devices per Splunk server

rbruno7
Explorer

Hi There,

Here goes my first question.

I need to generate a list of all hosts reporting to each splunk server so I can properly migrate the servers reporting to Splunk-A server to a different Splunk-B instanc on a different data center.

Since most servers don' report every day I need to search on a large timeframe (some report once a week and others once a month).

The first command command that came to my mind is below:

index=company_host OR index=company_network startdaysago=30 | stats distinct_count(host) by splunk_server,host

It does the job but it is incredibly slow and heavy on the Splunk infrastructure.

Is there any magic way to get it done faster without relying on summary indexes?

Best Regards

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Just use:

| metadata type=hosts

Unfortunately, the |metadata command always runs in distributed mode and does not break out results by splunk_server, so you might have to figure out a way to run it in non-distributed mode on each individual server to get the list for each indexer.

You could also just go into the $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ directory (or wherever you keep your indexes hot/warm db) and look in the Hosts.data file on each server, and repeat for each index you're interested in.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Just use:

| metadata type=hosts

Unfortunately, the |metadata command always runs in distributed mode and does not break out results by splunk_server, so you might have to figure out a way to run it in non-distributed mode on each individual server to get the list for each indexer.

You could also just go into the $SPLUNK_HOME/var/lib/splunk/defaultdb/db/ directory (or wherever you keep your indexes hot/warm db) and look in the Hosts.data file on each server, and repeat for each index you're interested in.

blebit
Path Finder

great answer

0 Karma

rbruno7
Explorer

This was the magic answer I was looking for!
Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...