topic Splunk Host Reporting in Getting Data In

topic Splunk Host Reporting in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556275#M92091 <P>I am looking for a Query where we can set up monitoring and alert  which can tell us how many Host are Reporting and Non Reporting accordingly alert is set up.</P><P>Sources are not Reporting from last 24 hours need to set up alert.</P><P> </P><P>Can you Please assist.</P> Fri, 18 Jun 2021 05:37:35 GMT ssahil 2021-06-18T05:37:35Z Splunk Host Reporting https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556275#M92091 <P>I am looking for a Query where we can set up monitoring and alert  which can tell us how many Host are Reporting and Non Reporting accordingly alert is set up.</P><P>Sources are not Reporting from last 24 hours need to set up alert.</P><P> </P><P>Can you Please assist.</P> Fri, 18 Jun 2021 05:37:35 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556275#M92091 ssahil 2021-06-18T05:37:35Z Re: Splunk Host Reporting https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556290#M92092 <P>If you know all the hosts you are expecting to "report", search the indexes in the last 24 hours and see which ones don't have any results. Do you have a list of hosts in a lookup?</P> Fri, 18 Jun 2021 07:12:21 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556290#M92092 ITWhisperer 2021-06-18T07:12:21Z Re: Splunk Host Reporting https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556320#M92093 <P>No We don't have list of Lookup file.</P><P> </P><P>Can you help the Query to extract the data </P> Fri, 18 Jun 2021 09:39:17 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556320#M92093 ssahil 2021-06-18T09:39:17Z Re: Splunk Host Reporting https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556322#M92094 <LI-CODE lang="markup">| stats latest(_time) as lastreport by host</LI-CODE> Fri, 18 Jun 2021 09:45:03 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556322#M92094 ITWhisperer 2021-06-18T09:45:03Z Re: Splunk Host Reporting https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556378#M92100 <P>From community slack!missinghosts </P><P> </P><P>There are a lot of options for finding hosts or sources that stop submitting events: </P><P>Meta Woot! <A href="https://splunkbase.splunk.com/app/2949/" target="_blank">https://splunkbase.splunk.com/app/2949/</A> </P><P>TrackMe <A href="https://splunkbase.splunk.com/app/4621/" target="_blank">https://splunkbase.splunk.com/app/4621/</A> </P><P>Broken Hosts App for Splunk <A href="https://splunkbase.splunk.com/app/3247/" target="_blank">https://splunkbase.splunk.com/app/3247/</A> </P><P>Alerts for Splunk Admins ("ForwarderLevel" alerts) <A href="https://splunkbase.splunk.com/app/3796/" target="_blank">https://splunkbase.splunk.com/app/3796/</A> </P><P>Monitoring Console <A href="https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring</A> </P><P>Deployment Server <A href="https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarder_warnings" target="_blank">https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarder_warnings</A> </P><P> </P><P>Some helpful posts: </P><P><A href="https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe" target="_blank">https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe</A> </P><P><A href="https://www.duanewaddle.com/proving-a-negative/" target="_blank">https://www.duanewaddle.com/proving-a-negative/</A></P> Sat, 19 Jun 2021 09:06:00 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-Reporting/m-p/556378#M92100 gjanders 2021-06-19T09:06:00Z