Filtering all hosts NOT in any host group

[Enrico_F]

I would like to identify all active hosts in my SaaS environment that are NOT members of any host group e.g. as a list of host names.

What would be the easiest way to achieve this preferably via UI or an entity selector?

[Esam_Eid]

Hi @Enrico_F ,

Usually we use Oneagent on a Host API to retrieve all the hosts details including the host group details, then we convert the json to CSV and filter the hosts with empty host group.

Regards, 

[Enrico_F]

Thanks @Esam_Eid 

I was hoping for a solution that doesn't require external filtering of the response, but it looks like there is none (surprisingly).

FWIW: Another workaround that also requires external response filtering would be going through the "Monitored entities" API via an entity selector like "type(HOST)" and filtering the response for hosts with an empty object "fromRelationships.isInstanceOf".

As the "OneAgent on a host" API seems painfully slow even without including the details I prefer using the "Monitored entities" API as a workaround for now (unless someone can suggest a better way).

[aeric-walls · Accepted solution]

Hi @Enrico_F, I have two ways, with DQL this is very easy to get the list and export to a CSV file.

fetch dt.entity.host
| filter isNull(hostGroupName)

 I'd suggest running this free DQL query in a notebook and an export to CSV option will appear.

That is all purely UI, no settings changes or API usage. If you're open to creating an auto tag in the UI, you could create a tag that tags hosts without host groups, then with the monitored entities API, use an entity selector like: 

type(HOST),tag(no-host-group)

This was a mix of demo and personal environments, so I've blocked host names, but trust they are there 😄

[Enrico_F]

Excellent, thanks a lot @aeric-walls !