topic Re: Validating if 100 nodes are on boarded in splunk indexes or not. If not ? in Splunk Search

Validating if 100 nodes are on boarded in splunk indexes or not. If not ?

jcorcoran508 — Fri, 08 Oct 2021 11:45:25 GMT

I have this task were I am successful in getting result sets from nodes that are present in my splunk instance.

How ever I can't find a way to announce in the spl syntax if the Name of the Node that doesn't exist with a Yes or no value in another field

i.e.

Node present

Appserver No

Re: Validating if 100 nodes are on boarded in splunk indexes or not. If not ?

gcusello — Fri, 08 Oct 2021 11:56:43 GMT

Hi @jcorcoran508,

I think that Node is the hostname or a field of each system that's sending logs.

In this way you could create a lookup (called e.g. perimeter.csv) containing all the Nodes to monitor (at least one field called e.g. Node or host, in the following example Node), then you have to run a search like this:

Ciao.

Giuseppe

Re: Validating if 100 nodes are on boarded in splunk indexes or not. If not ?

gcusello — Thu, 14 Oct 2021 06:13:12 GMT

Hi @jcorcoran508,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉