topic Re: how to search a service that not running on certain hosts in Splunk Search

how to search a service that not running on certain hosts

JamesJ — Wed, 04 Aug 2021 01:01:44 GMT

Dear Community,

I am writing a search for windows services. I am trying to find out the number of hosts that having/not having a certain service.

Here is the search that I have to find out servers that having the services running:

index=*_oswin sourcetype="WMI:Service" source="WMI:Service" Name="Appdynamics Machine Agent" | dedup host | stats sum()

How can I do the second part please? Also, I want to integrate those two numbers into one pie chart. Any suggestion is highly appreicated!

venkatasri — Wed, 04 Aug 2021 01:21:11 GMT

To find not running services you should have catalog list of services in a lookup or somewhere in splunk.

Can you describe what's first part, second part here that you want to see?

JamesJ — Wed, 04 Aug 2021 01:36:42 GMT

Hi Venk,

Thanks for replying.

The first part is to list all servers that having a particular service (e.g. Spooler) installed.

The second part is to list all servers that don't have this service installed.

Finally, I want to put the number into a pie chart.

Hope that makes sense.

gcusello — Wed, 04 Aug 2021 11:14:54 GMT

you have to create a lookup (called e.g. perimeter.csv) containing all the monitored servers (only one column with "host").

Then you hav e to modify your search having something like this:

Ciao.

Giuseppe

JamesJ — Wed, 04 Aug 2021 22:41:39 GMT

Appreciate the hints. I will go ahead with a try with input lookup.

Many thanks!

James