topic Re: Get list of servers not sending logs in Deployment Architecture

Get list of servers not sending logs

walia_sapient — Mon, 09 Sep 2019 12:04:05 GMT

i want to get list of servers from the csv which are not sending any logs to splunk like for past 48 hours with time when it stopped ingesting. i am trying below query but no success.

Re: Get list of servers not sending logs

gaurav_maniar — Mon, 09 Sep 2019 13:33:51 GMT

Hi,

If your are just looking for sever list, below query will do the work, (select time range for 48 hours)

| metadata type=hosts index=*
| lookup xyz.csv hostname as host OUTPUTNEW other_field as other_field
| where isnull(other_field)
| table host

other_field - select any field from the lookup

happy splunking .....!!!!

Re: Get list of servers not sending logs

somesoni2 — Mon, 09 Sep 2019 13:59:41 GMT

Try this

List the hosts who have not sent any data in last 48 hours.

| tstats count WHERE index=* earliest=-48h [| inputlookup xyz.csv |table hostname | rename hostname as host ] by host 
| append  [| inputlookup xyz.csv |table hostname | rename hostname as host | eval count=0 ] 
| stats max(count) as count by host | where count=0

Re: Get list of servers not sending logs

sanjeev543 — Mon, 09 Sep 2019 16:53:16 GMT

Please try below query

Re: Get list of servers not sending logs

walia_sapient — Tue, 10 Sep 2019 12:19:38 GMT

It didn't work giving false results

Re: Get list of servers not sending logs

walia_sapient — Tue, 10 Sep 2019 12:20:00 GMT

shows error in the query

Re: Get list of servers not sending logs

sanjeev543 — Tue, 10 Sep 2019 13:02:08 GMT

@walia_sapient Could you please give the error message ?

Re: Get list of servers not sending logs

walia_sapient — Tue, 10 Sep 2019 13:10:49 GMT

okay there was a extra dot in the query mistakenly , errors removed but the query is not returning any results though there are few servers from csv which are not sending logs

Re: Get list of servers not sending logs

sanjeev543 — Tue, 10 Sep 2019 13:47:56 GMT

For me it did work, however there is otherway

| tstats latest(_time) as l earliest(_time) as e where index=* host IN (x,y,z,a,.......) by host | eval diff=now()-l | eval diff_in_days = round(diff/86400,2) | convert ctime(l) as lasttime ctime(e) as first | where diff_in_days>1

place the host names from your CSV the above query for host IN by separating them with ,

Re: Get list of servers not sending logs

Luthufudheen — Tue, 22 Sep 2020 15:32:52 GMT

Please refer below to get list of host which are not sending logs without using a lookup.

https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-determine-when-a-host-stops-sending-logs-to-splunk-expeditiously.html