https://community.splunk.com/t5/Getting-Data-In/How-to-list-hosts-with-no-events/m-p/71505#M14550 <P>This should help. Note that when the search comes back empty you don't have any hosts that are not currently sending data during the specific time period.</P> <P><A href="http://splunk-base.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data">http://splunk-base.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data</A></P> Fri, 22 Mar 2013 13:37:42 GMT sdaniels 2013-03-22T13:37:42Z https://community.splunk.com/t5/Getting-Data-In/How-to-list-hosts-with-no-events/m-p/71504#M14549 <P>Hi! I'm trying to find out hosts that are not sending any data to Splunk at certain time frame. Using command "host=* | chart count by host" I can get a list of hosts with event count summary, but it doesn't show those where the value is 0. Is there a way to get a list of hosts with no events?<BR /> Thanks!</P> Fri, 22 Mar 2013 13:32:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-list-hosts-with-no-events/m-p/71504#M14549 Susannajuurinen 2013-03-22T13:32:58Z https://community.splunk.com/t5/Getting-Data-In/How-to-list-hosts-with-no-events/m-p/71505#M14550 <P>This should help. Note that when the search comes back empty you don't have any hosts that are not currently sending data during the specific time period.</P> <P><A href="http://splunk-base.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data">http://splunk-base.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data</A></P> Fri, 22 Mar 2013 13:37:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-list-hosts-with-no-events/m-p/71505#M14550 sdaniels 2013-03-22T13:37:42Z