topic Re: Search to Identify when a specificy event stops sending logs to Splunk in Splunk Enterprise

Search to Identify when a specificy event stops sending logs to Splunk

leandromatperei — Tue, 03 Nov 2020 13:37:34 GMT

I have this search string to identify certain events from extensions that stopped sending logs to Splunk, The specific event is below, I saw some examples using hosts, would it be possible instead of hosts, certain fields in the log? In this specific example, the extension appears in the log, but I need to know if it is not within the 07 day period.

index = raw_ramal EXTENSION: 11111111 (That number can be changed, there are thousands of it.

The query below shows me the number of events of the extensions, but it does not help me to locate when any of them stopped having registration in the last 07 days.

index=raw_ramal "EXTENSION:" | rex field=_raw "EXTENSION:(?<EXTENSION>\+?\d+)" | stats count by EXTENSION

Re: Search to Identify when a specificy event stops sending logs to Splunk

richgalloway — Tue, 03 Nov 2020 13:39:59 GMT

Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

Re: Search to Identify when a specificy event stops sending logs to Splunk

leandromatperei — Tue, 03 Nov 2020 14:00:26 GMT

Thanks.

This content helped me to understand a little more, and it has to do with what I need. However, in the query that I have, I need to know only a specific list of extensions (about 250) that I need to check daily, when I set up the query below, it brought everyone, even those that are not in my spreadsheet, how can I filter to display the count only of those in my csv?

My list has 250 events, but Splunk even has extensions that are not the ones I want to filter.