I'm sure there is a better way. I'm trying to get a list of hosts for a given time range. The search I'm using now is
host=* | table host
this can take a long time to run dependent on the time range I'm looking at.
You can use either of these, depending on what you'd like displayed:
| metadata type=hosts | table host
OR
| metadata type=hosts | stats count by host
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!
You can use either of these, depending on what you'd like displayed:
| metadata type=hosts | table host
OR
| metadata type=hosts | stats count by host
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!