https://community.splunk.com/t5/Splunk-Enterprise/Health-monitoring/m-p/375791#M1163 <P>Thank you </P> Mon, 19 Feb 2018 06:34:52 GMT yav2810 2018-02-19T06:34:52Z https://community.splunk.com/t5/Splunk-Enterprise/Health-monitoring/m-p/375789#M1161 <P>The system sends the information (the value of the counter) about the number of events transmitted during this time interval approximately in 5 minutes. It is necessary to build a monitoring system - to display information about sources that do not transmit events. The task is divided into 2 blocks: 1 - the source is available, but the counter value is zero, 2 - the source is not available (events do not arrive at Splunk at all).</P> <P>The first task is easily solved. It builds statistics on the number of devices that transmitted events in the last hour, but the counter was zero:</P> <PRE><CODE>query | stats sum(cn2) as tCount by shost | where tCount=0 | stats count(shost) </CODE></PRE> <P>cn2 - counter</P> <P>Outputting a list of sources that pass the counter value to zero:</P> <PRE><CODE>query | stats sum(cn2) as tCount by shost | where tCount=0 | fields shost </CODE></PRE> <P>The second task is more complicated. I consider the number of devices from which messages were received in the last hour:</P> <PRE><CODE>query | dedup shost | stats count(shost) as tCount </CODE></PRE> <P>It remains to solve the problem of obtaining a list of devices that did not wait for events in the last hour (were not available). I ask to help with the decision of the given task</P> Thu, 15 Feb 2018 06:28:09 GMT https://community.splunk.com/t5/Splunk-Enterprise/Health-monitoring/m-p/375789#M1161 yav2810 2018-02-15T06:28:09Z https://community.splunk.com/t5/Splunk-Enterprise/Health-monitoring/m-p/375790#M1162 <P>For example, you can search by this search sentence.</P> <PRE><CODE>|tstats count by host|search NOT [search index=* earliest=-1h|dedup host|table host] OR |inputlookup host_list.csv|search NOT [search index=* earliest=-1h|dedup host|table host] </CODE></PRE> Thu, 15 Feb 2018 08:59:02 GMT https://community.splunk.com/t5/Splunk-Enterprise/Health-monitoring/m-p/375790#M1162 HiroshiSatoh 2018-02-15T08:59:02Z https://community.splunk.com/t5/Splunk-Enterprise/Health-monitoring/m-p/375791#M1163 <P>Thank you </P> Mon, 19 Feb 2018 06:34:52 GMT https://community.splunk.com/t5/Splunk-Enterprise/Health-monitoring/m-p/375791#M1163 yav2810 2018-02-19T06:34:52Z