https://community.splunk.com/t5/Dashboards-Visualizations/Finding-missing-events/m-p/67958#M3609 <P>A look up will probably work best. You can just list the IP addresses in a .csv file.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups">http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups</A></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources#Example_of_external_fields_lookup">http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources#Example_of_external_fields_lookup</A></P> Tue, 05 Jun 2012 19:24:29 GMT sdaniels 2012-06-05T19:24:29Z https://community.splunk.com/t5/Dashboards-Visualizations/Finding-missing-events/m-p/67957#M3608 <P>For instance, let's say I have a list of IP addresses that I expect should show up in an FTP log each day. If I don't see any activity for a few days, I want to report/alert on that. I know that seems a little bit out of the normal splunk use case but I'm wondering if it can be done.</P> <P>It would seem that I need to get splunk to understand which IP addresses I expect before I can join it to a search which has the extracted IP. What's the best way of defining these IP addresses? </P> <P>I've tried creating an XML web service which is consumed as a scripted input. I've been able to extract the fields with spath expressions but I'm not sure how to take the fields and join them to another search. Does this seem like a reasonable approach or am I over complicating this? I have a tendency to do that <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 05 Jun 2012 19:19:45 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Finding-missing-events/m-p/67957#M3608 mcantrell 2012-06-05T19:19:45Z https://community.splunk.com/t5/Dashboards-Visualizations/Finding-missing-events/m-p/67958#M3609 <P>A look up will probably work best. You can just list the IP addresses in a .csv file.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups">http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups</A></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources#Example_of_external_fields_lookup">http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources#Example_of_external_fields_lookup</A></P> Tue, 05 Jun 2012 19:24:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Finding-missing-events/m-p/67958#M3609 sdaniels 2012-06-05T19:24:29Z https://community.splunk.com/t5/Dashboards-Visualizations/Finding-missing-events/m-p/67959#M3610 <P>Thanks. This gives me a good place to start.</P> Tue, 05 Jun 2012 20:10:38 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Finding-missing-events/m-p/67959#M3610 mcantrell 2012-06-05T20:10:38Z