topic Re: Identify missing servers in Splunk Search

Identify missing servers

Muthu_Vinith — Fri, 08 Dec 2023 14:49:41 GMT

Hi,

I have two datasets for example –

1.Index=abc host=def_inven, consider as Dataset A (inventory with 100 servers) and

2.lookup = something, consider as Dataset B (monitored in Splunk with 80 servers).

How can I identify the 20 servers missing ?

Re: Identify missing servers

richgalloway — Fri, 08 Dec 2023 14:52:38 GMT

Use a subsearch to exclude the lookup file from the index results.

index=abc host=def_inven NOT [ | inputlookup something | fields <a field from the lookup that identifies a server> | rename <field> as <some field name in Dataset A> ]

Re: Identify missing servers

Muthu_Vinith — Fri, 08 Dec 2023 17:18:12 GMT

I tried this method, but unfortunately i couldn't get exact results. It's showing only index data. Is there any different method instead of append can we use join command? Can you suggest different logic
@richgalloway

Re: Identify missing servers

richgalloway — Fri, 08 Dec 2023 17:52:06 GMT

This is the point where you show the search(es) you ran, their results, and tell how those results miss expectations. Does the lookup file contain data that can be used to search the index? If not, can it be modified or can the search modify a lookup field into something that's in the index?

Re: Identify missing servers

Muthu_Vinith — Fri, 08 Dec 2023 20:15:50 GMT

No, in lookup file there are few servers which are monitored, but also in index some servers which is monitored but I need to find which is not monitored.

Is it possible to try something like this for example:

index=abc host=def_inven

•if it is in inventory flag it

flag inven= something

join

lookup <>
flag splunk=something

so we can use |stats values by flag
Whether this logic is correct? If it is ok give a exact query or suggest me something different query

@richgalloway

Re: Identify missing servers

richgalloway — Fri, 08 Dec 2023 20:23:49 GMT

The first query I gave you should have worked, but the logic you just suggested should work, too. This query marks servers from the index as "indexed" and those from the lookup file as "lookup". After combining the results by server name, it keeps only the servers found in the index.

Re: Identify missing servers

Muthu_Vinith — Sat, 09 Dec 2023 07:11:21 GMT

It Works, Thank You @richgalloway

Re: Identify missing servers

richgalloway — Sat, 09 Dec 2023 13:20:43 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.