https://community.splunk.com/t5/Alerting/Alert-for-Finding-Systems-that-Stopped-Reporting/m-p/542856#M10294 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232231">@uofrmike</a>,</P><P>using join with so many events (like _internal) will surely be a very slow search.</P><P>Please try a different approach:</P><LI-CODE lang="markup">index=_internal earliest=-3d@d latest=now | eval day=if(now()-_time&lt;86400,"Last day","Previous days") | stata dc(day) AS dc_day values(day) AS day count BY host | where dc_day=1 AND day="Previous days"</LI-CODE><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Mon, 08 Mar 2021 15:58:51 GMT gcusello 2021-03-08T15:58:51Z https://community.splunk.com/t5/Alerting/Alert-for-Finding-Systems-that-Stopped-Reporting/m-p/542852#M10293 <P>I created the following alert for finding systems that have recently stopped reporting.&nbsp; I haven't seen a similar solution to this problem so I thought I would post it here in hopes that it might help others.</P><P>&nbsp;</P><P>This alert will find hosts that haven't sent data within the last day, but have in the days previous.&nbsp; It's set for the 3 days prior, but can be changed to a longer duration.&nbsp; It will report each host for 3 days to allow time for the admins to take action to get the system online.</P><P>&nbsp;</P><P>Suggest that the alert be set to run daily.</P><P>&nbsp;</P><P>&nbsp;</P><P>index=_internal source=*license_usage.log type=Usage earliest=-5d@d latest=-2d@d<BR />| eval HostSource=idx . " / " . h . " / " . st<BR />| fields HostSource<BR />| dedup HostSource<BR />| eval PAST="YES"<BR />| join type=outer HostSource [ search index=_internal source=*license_usage.log type=Usage earliest=-2d@d latest=-1d@d | eval HostSource=idx . " / " . h . " / " . st | fields HostSource | dedup HostSource | eval PRESENT="YES" ]<BR />| where isnull(PRESENT)<BR />| table HostSource<BR />| sort by HostSource</P> Mon, 08 Mar 2021 15:32:47 GMT https://community.splunk.com/t5/Alerting/Alert-for-Finding-Systems-that-Stopped-Reporting/m-p/542852#M10293 uofrmike 2021-03-08T15:32:47Z https://community.splunk.com/t5/Alerting/Alert-for-Finding-Systems-that-Stopped-Reporting/m-p/542856#M10294 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232231">@uofrmike</a>,</P><P>using join with so many events (like _internal) will surely be a very slow search.</P><P>Please try a different approach:</P><LI-CODE lang="markup">index=_internal earliest=-3d@d latest=now | eval day=if(now()-_time&lt;86400,"Last day","Previous days") | stata dc(day) AS dc_day values(day) AS day count BY host | where dc_day=1 AND day="Previous days"</LI-CODE><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Mon, 08 Mar 2021 15:58:51 GMT https://community.splunk.com/t5/Alerting/Alert-for-Finding-Systems-that-Stopped-Reporting/m-p/542856#M10294 gcusello 2021-03-08T15:58:51Z