All Apps and Add-ons

host integrated details with hostname,, index, sourcetype and source

Rody333
New Member

I want to fetch what all devices integrated to splunk and sending logs. I don't have admin rights and having access to Search Head only.
Pls advise how to fetch host integrated details with hostname, index, sourcetype and source.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try these:

| tstats count values(sourcetype) where index=* BY index

And:

| tstats count values(host) where index=* BY sourcetype

Or maybe combined like this:

| tstats count where index=* BY host sourcetype index
| stats list(count) AS host_total list(host) AS host sum(count) AS sourcetype_total BY sourcetype index
| nomv host
| nomv host_total
| stats list(host) AS host list(host_total) AS host_total sum(sourcetype_total) AS sourcetype_total BY index

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try these:

| tstats count values(sourcetype) where index=* BY index

And:

| tstats count values(host) where index=* BY sourcetype

Or maybe combined like this:

| tstats count where index=* BY host sourcetype index
| stats list(count) AS host_total list(host) AS host sum(count) AS sourcetype_total BY sourcetype index
| nomv host
| nomv host_total
| stats list(host) AS host list(host_total) AS host_total sum(sourcetype_total) AS sourcetype_total BY index
0 Karma

Rody333
New Member

Thanks a lot woodcock. It really helps

0 Karma

woodcock
Esteemed Legend

When you are done gathering answers, be sure to pick one and click Answer to close it out.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Run this

| metasearch index=* sourcetype=* 
| table index source host sourcetype
0 Karma

Rody333
New Member

Hi skoelpin, Thanks for your help. Need another help. It's a huge data with redundancy.. can you tell me if result can have distinct values

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...