https://community.splunk.com/t5/Getting-Data-In/Query-for-host-not-sending-sourcetype/m-p/45721#M8592 <P>There's a query for virtually everything <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I'd go along this path: Compute a list of all your hosts and subtract the list of hosts sending the particular sourcetype... something like this:</P> <PRE><CODE>| metadata type=hosts index=* | fields host | search NOT [search index=* sourcetype=particular | fields host | dedup host] </CODE></PRE> <P>Note, replace index=* if you only want to search a specific set of indexes.</P> Fri, 24 May 2013 22:28:39 GMT martin_mueller 2013-05-24T22:28:39Z https://community.splunk.com/t5/Getting-Data-In/Query-for-host-not-sending-sourcetype/m-p/45720#M8591 <P>I am trying to find out how to identify which host(s) are not sending a particular datasource. Is there a query to identify this?</P> Fri, 24 May 2013 17:38:27 GMT https://community.splunk.com/t5/Getting-Data-In/Query-for-host-not-sending-sourcetype/m-p/45720#M8591 diegosainz 2013-05-24T17:38:27Z https://community.splunk.com/t5/Getting-Data-In/Query-for-host-not-sending-sourcetype/m-p/45721#M8592 <P>There's a query for virtually everything <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I'd go along this path: Compute a list of all your hosts and subtract the list of hosts sending the particular sourcetype... something like this:</P> <PRE><CODE>| metadata type=hosts index=* | fields host | search NOT [search index=* sourcetype=particular | fields host | dedup host] </CODE></PRE> <P>Note, replace index=* if you only want to search a specific set of indexes.</P> Fri, 24 May 2013 22:28:39 GMT https://community.splunk.com/t5/Getting-Data-In/Query-for-host-not-sending-sourcetype/m-p/45721#M8592 martin_mueller 2013-05-24T22:28:39Z