Splunk Search

How to search for a list of hosts and the count of events that have been indexed per day for each host?

dolejh76
Communicator

I am sure that this has been asked and answered but I cant find a format that gives me what I am looking for.

I would like to get a list of hosts and the count of events per day from that host that have been indexed. Essentially I would like to take this to management and show ROI that looks at the millions of events each day from these hosts that have been indexed.

So it would show

Hosts 12/1 12/2 12/3 12/4 (last 7 or 30 days)
Host1 xxxx xxxx xxxx xxxx
Host 2 xxxx xxxx xxxx xxxx
Firewall xxxx xxxx xxxx xxxx
etc

xxxx = number of events indexed

Any help is appreciated - thanks

Tags (4)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi dolejh76,

try something like this:

your base search here | timechart span=1d count by host

hope it helps ...

cheers, MuS

View solution in original post

yannK
Splunk Employee
Splunk Employee

If you prefer the other way, (date at columns, rows as hosts )

< mysearch >  | bucket _time span=1d  
|convert ctime(_time) AS date timeformat="%Y/%m/%d" 
| chart count over host by date

MuS
SplunkTrust
SplunkTrust

Hi dolejh76,

try something like this:

your base search here | timechart span=1d count by host

hope it helps ...

cheers, MuS

dolejh76
Communicator

That helped thanks - one more for you - what about size in KB for the same data? This way I can show how much of our license each host is chewing up per day?

Thanks
John

0 Karma

MuS
SplunkTrust
SplunkTrust

Sure, on your license master search the internal index for the source license_usage.log like this:

index=_internal source="*license_usage.log" | timechart span=1d sum(eval(b/1024)) AS KB by h | rename h AS host

cheers, MuS

dolejh76
Communicator

I like this report - unfortunately... there is a NULL field that has a considerable amount of data usage? Any idea what that would be? At this point we are ONLY pulling in wineventlogs and AD data - so it shouldn't be this high...

Looks like there is an "OTHER" Field as well.... so what is "OTHER" and "NULL"

Thanks
JD

0 Karma

MuS
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...