topic Splunk Query to find removed hosts in Splunk Search

Splunk Query to find removed hosts

alexspunkshell — Thu, 28 Jan 2021 13:24:19 GMT

Hi All,

Please help me with splunk query to find removed (Off-boarded) hosts & index in splunk

Re: Splunk Query to find removed hosts

richgalloway — Thu, 28 Jan 2021 13:55:39 GMT

Could you please be more specific about the use case? Which hosts, those monitored by Splunk or those running Splunk? Do you also want to detect removed indexes or index removed hosts?

Re: Splunk Query to find removed hosts

alexspunkshell — Thu, 28 Jan 2021 14:22:26 GMT

@richgalloway Thanks for your reply.

Splunk query for removed hosts those are monitored by Splunk.

Re: Splunk Query to find removed hosts

richgalloway — Thu, 28 Jan 2021 19:53:20 GMT

Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/