Splunk Search

What is the quickest way to see if a host was ever indexed in Splunk?

a212830
Champion

Hi,

What's the quickest way to see if a host was ever indexed in Splunk? I don't want to do an alltime search. Would metadata help?

Tags (2)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Yes Sir, the metadata command will give you list of hosts which have forwarded/sent data to Splunk along with the last time they sent the data.

|metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time

If you have a list of host you want to validate, like in a lookup table file, then you can join that with these results to see which host is missing.

   |metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time | append [|inputlookup hostlist.csv | table host | eval recentTime="NA"] | stats values(recentTime) as recentTime by host | where mvcount(recentCount)=1 AND recentCount="NA"

View solution in original post

tmontney
Builder

Somewhat basing this off somesoni2's answer:

| rest /services/deployment/server/clients splunk_server=local
| eval recentTime="N/A"
| rename instanceName AS host
| append [| metadata type=hosts index=* | where NOT like(host, "%.%")]
| stats values(recentTime) as recentTime by host
| where mvcount(recentTime)=1 AND recentTime="N/A"

This will check for forwarders that are...

  • Phoning home
  • Are not an IP address (could probably use a regex to be more accurate)
  • Haven't sent to any non-internal index

Using a lookup table is nice, but in many cases you have to keep maintaining it. Why not use the forwarder's "table"?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Yes Sir, the metadata command will give you list of hosts which have forwarded/sent data to Splunk along with the last time they sent the data.

|metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time

If you have a list of host you want to validate, like in a lookup table file, then you can join that with these results to see which host is missing.

   |metadata type=hosts index=* OR index=_* | convert ctime(*Time) as *Time | append [|inputlookup hostlist.csv | table host | eval recentTime="NA"] | stats values(recentTime) as recentTime by host | where mvcount(recentCount)=1 AND recentCount="NA"

a212830
Champion

Thanks. I'll try to go back and update them. I appreciate the help.

0 Karma

ppablo
Retired

Hi @a212830

I'm glad @somesoni2 answered your question 🙂 Please be sure to accept the correct answers to your questions by clicking on the big check mark next to the answer that solved your issue. This helps other users who have similar questions and can turn to your posts for help and prevents people from asking the same questions over and over. A good number of your previous posts have solutions but you haven't accepted the answers. I can go through them, but it'll be a big help if you could accept correct answers from now on.

Thanks!

Patrick

0 Karma

a212830
Champion

fantas-TIC. Thanks.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...