What is the command to check the list of all servers or IP Address which Splunk is monitoring currently?

[phanichintha]

Command or Solution to get the list of IP Address or servers list or Hostnames, which are Splunk is monitoring currently.

[DavidHourani]

Hi @phanichintha,

Your question is similar to this one :
https://answers.splunk.com/answers/747065/how-to-set-up-an-alert-when-an-server-goes-down-or.html

So you can simply run this command and it will give you the list of servers that sent logs in the last 10 minutes :

 |metadata type=hosts index=_* index=*
 |where now()-lastTime > 600

Run it over all time to get the whole list of servers. This runs on metadata so you should get your results almost instantly even if you use all time.

Cheers,
David

[koshyk · Accepted solution]

To see where what you are collecting data from (extend this to 7 days or something)

|tstats latest(_time) as latest_indexed WHERE index=* by host

If you have monitoring Console, you can get list of all Splunk Forwarders (UF & HF etc) to get the list. This should be run on system which have MC/DMC working.

| inputlookup dmc_forwarder_assets

cheers