https://community.splunk.com/t5/Getting-Data-In/How-do-you-check-missing-values-from-an-input-list-and-set-an/m-p/388612#M69578 <P>I have a scenario wherein each heavy forwarder has syslog listeners running. I need an alert or something in the dashboard to show that a particular heavy forwarder has the following listener down.</P> <P>I did the following and was able to list the Splunk heavy forwarder, listener and its associated PID:</P> <PRE><CODE> index=operatingsys host=hf1 OR host=hf2 or host=hf3 source="/var/run/syslog/*" | rex .......... | table host listenername PID o/p was as follows host listenername PID hf1 ciscolistener 123 hf1 winlistener 567 hf2 ciscolistener 345 hf2 winlistener 789 hf3 ciscolistener 654 hf3 winlistener 523 hf3 whitecoat 231 </CODE></PRE> <P>Now , I can share an input CSV list as below which is static</P> <PRE><CODE>host listenername hf1 ciscolistener hf1 winlistener hf1 whitecoat hf2 ciscolistener hf2 winlistener hf2 whitecoat hf3 ciscolistener hf3 whitecoat hf3 winlistener </CODE></PRE> <P>As you see in my search output, hf2 and hf3 have whitecoat missing (meaning whitecoat listener status is down, and technically, it will not have PID assigned as it is down). I need to show that the listeners on the heavies are down in a dashboard/report, and for an alert to be generated whenever any listener is down on one of our heavy forwarders.</P> <P>Open to discussion on using any different approach, if possible to wrap this up</P> Thu, 14 Feb 2019 20:06:46 GMT RishiMandal 2019-02-14T20:06:46Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-check-missing-values-from-an-input-list-and-set-an/m-p/388612#M69578 <P>I have a scenario wherein each heavy forwarder has syslog listeners running. I need an alert or something in the dashboard to show that a particular heavy forwarder has the following listener down.</P> <P>I did the following and was able to list the Splunk heavy forwarder, listener and its associated PID:</P> <PRE><CODE> index=operatingsys host=hf1 OR host=hf2 or host=hf3 source="/var/run/syslog/*" | rex .......... | table host listenername PID o/p was as follows host listenername PID hf1 ciscolistener 123 hf1 winlistener 567 hf2 ciscolistener 345 hf2 winlistener 789 hf3 ciscolistener 654 hf3 winlistener 523 hf3 whitecoat 231 </CODE></PRE> <P>Now , I can share an input CSV list as below which is static</P> <PRE><CODE>host listenername hf1 ciscolistener hf1 winlistener hf1 whitecoat hf2 ciscolistener hf2 winlistener hf2 whitecoat hf3 ciscolistener hf3 whitecoat hf3 winlistener </CODE></PRE> <P>As you see in my search output, hf2 and hf3 have whitecoat missing (meaning whitecoat listener status is down, and technically, it will not have PID assigned as it is down). I need to show that the listeners on the heavies are down in a dashboard/report, and for an alert to be generated whenever any listener is down on one of our heavy forwarders.</P> <P>Open to discussion on using any different approach, if possible to wrap this up</P> Thu, 14 Feb 2019 20:06:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-check-missing-values-from-an-input-list-and-set-an/m-p/388612#M69578 RishiMandal 2019-02-14T20:06:46Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-check-missing-values-from-an-input-list-and-set-an/m-p/388613#M69579 <P>try this:</P> <PRE><CODE>index=operatingsys host=hf1 OR host=hf2 or host=hf3 source="/var/run/syslog/*" | rex .......... | table host listenername PID | append [|inputlookup CSV_LIST | fields host listenername ] | stats latest(*) as * by host listenername </CODE></PRE> <P>By the way, if your CSV has different field names in it, you can use an <CODE>eval</CODE> or <CODE>rename</CODE> in the subsearch.</P> <P>All the best</P> Thu, 14 Feb 2019 20:21:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-check-missing-values-from-an-input-list-and-set-an/m-p/388613#M69579 chrisyounger 2019-02-14T20:21:51Z