Hey Guys
So I have a sourcetype of syslog, but under that sourcetype seems to be a whole bunch of hosts. What's the best search to list all the hosts sending under the syslog sourcetype?
Sorry for such a basic question, I'm not too bad at making Splunk work, but actually using it for searches etc I'm not so hot.
Cheers
Aaron
sourcetype=syslog | stats count by host
Or, you could use something like this to see how much data each host is sending:
sourcetype=syslog | eval length=len(_raw) | stats sum(length) by host
Hi Aaron, if you wanted a quick simple count, this might be a good use for tstats, which will usually finish faster than a normal search.
| tstats count where sourcetype=syslog by host
I can vouch for that
Thank you, that also seems to work well, no doubt ill be needing more help with some simple searches over the coming days. I have to try and break down everything that is being logged into categories and generally have a tidy up.
sourcetype=syslog | stats count by host
Or, you could use something like this to see how much data each host is sending:
sourcetype=syslog | eval length=len(_raw) | stats sum(length) by host
That Iooks to be doing what I need, thank you Sir...