Allgemeine Befehle - Splunk Search Head

Search all Versions of the Splunk Universal Forwarder (Agent)

index=_internal source=*metrics.log component=Metrics group=tcpin_connections 
| dedup hostname 
| table hostname, sourceIp, os, arch, version

Unique Table (jeweils nur eine Zeile pro Property "host")

index=<Index-Name> | dedup <Feld-Name> | table <Feld-Name>

Alle Indexes und deren Usage anzeigen (Gruppiert nach Monat)

index=_internal source="*license_usage.log" type=usage idx="*" | eval MB = round(b/1048576,2) | eval st_idx = st.": ".idx | timechart span=1mon sum(MB) by st_idx | addtotals

Letzter Kommunikation/Log eines Hosts anzeigen (per Feld "vmid")

| tstats latest(_time) as time latest(vmid) as vmid where index=_internal by host | eval time=strftime(time, "%d.%m.%Y %H:%M:%S")