topic Re: Query for hosts not sending logs is no longer showing results in Splunk Search

Why is search for hosts not sending logs and no longer showing results?

neerajs_81 — Wed, 16 Nov 2022 06:15:51 GMT

Hello, We have been using this query to list out hosts that are not sending logs since past 24h. It has been working well and for some unknown reason it has now suddenly stopped working. In the sense it does not show any results despite there r hosts that meet the condition. Can someone pls help to figure out why ?

Our lookupfile has 700 hosts . Now if i reverse the where condition (just for testing) as shown below ,

where lastSeen_epoch > relative_time(now(),"-24H")

it shows 694 results meaning there are 6 hosts (700-694) that are not logging. So why is the original query not display the 6 hosts ?

Thanks

Re: Query for hosts not sending logs is no longer showing results

gcusello — Tue, 15 Nov 2022 14:17:00 GMT

Hi @neerajs_81,

maybe it will be a stupid try, but adding equal to the condition?

Ciao.

Giuseppe

Re: Query for hosts not sending logs is no longer showing results

neerajs_81 — Tue, 15 Nov 2022 16:01:03 GMT

That didn't work either. It shows 0 results. Thanks for responding.

Re: Query for hosts not sending logs is no longer showing results

gcusello — Tue, 15 Nov 2022 16:36:24 GMT

Hi @neerajs_81,

please try ths different search:

Ciao.

Giuseppe

Ciao.

Giuseppe

Re: Query for hosts not sending logs is no longer showing results

neerajs_81 — Wed, 16 Nov 2022 05:22:59 GMT

@gcusello That query worked. So how is it that this one is working while the earlier isn't ? Secondly can you pls clarify why are we appending the same lookup file again when we have already called the lookup file at the beginning ?

| append [ | inputlookup linux_deployed_servers | eval host=lower(host), count=0 | table host count ]

Re: Query for hosts not sending logs is no longer showing results

gcusello — Wed, 16 Nov 2022 07:10:44 GMT

Hi @neerajs_81,

the subsearch using the lookup at the beginning is only to limit the main search only to the servers of the lookup and avoid other results.

The real check is made after the append.

Ciao.

Giuseppe

Re: Query for hosts not sending logs is no longer showing results

neerajs_81 — Wed, 16 Nov 2022 12:31:10 GMT

Curious - any way to further optimize your search to also make it show LastSeenTime of those hosts ? Even if its in epoch i can convert it into human readable format . I tried the following way in your stats command but the lastSeen column comes out empty.

| stats sum(count) AS total max(_time) as lastTime BY host

Re: Query for hosts not sending logs is no longer showing results

gcusello — Wed, 16 Nov 2022 12:59:00 GMT

Hi @neerajs_81,

it's correct: the algorithm of my search is that total is equal to zero only when there isn't any event in the main search, so you cannot have the LastSeen value.

Maybe this is the problem of your original search.

Ciao.

Giuseppe

Re: Query for hosts not sending logs is no longer showing results

neerajs_81 — Wed, 16 Nov 2022 13:18:30 GMT

Ahh. Didn't realize that. Thanks