https://community.splunk.com/t5/Splunk-Search/Alert-for-specific-missing-events/m-p/690020#M235060 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228757">@marco_massari11</a>&nbsp;,</P><P>you should run something ike this (if the search is only on index, host, source and sourcetype</P><LI-CODE lang="markup">| tstats count WHERE index=your_index BY host | append [ | inputlookup your_lookup.csv | eval count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>If you have to use a more comples search, you can use</P><LI-CODE lang="markup">&lt;your_search&gt; | stats count BY host | append [ | inputlookup your_lookup.csv | eval count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 07 Jun 2024 15:03:58 GMT gcusello 2024-06-07T15:03:58Z https://community.splunk.com/t5/Splunk-Search/Alert-for-specific-missing-events/m-p/690004#M235059 <P>Hello,</P><P>I need to monitor some critical devices (stored in a lookup file) connected to the Crowdstrike console, in particular if they will be disconnected from it. We receive one event every 2 hours for each device from Crowdstrike device json input in Splunk, so basically if after 2 hours there is not the new event, the alert should trigger reporting the hostname. Has anyone some idea for implementing this?</P> Fri, 07 Jun 2024 14:54:26 GMT https://community.splunk.com/t5/Splunk-Search/Alert-for-specific-missing-events/m-p/690004#M235059 marco_massari11 2024-06-07T14:54:26Z https://community.splunk.com/t5/Splunk-Search/Alert-for-specific-missing-events/m-p/690020#M235060 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228757">@marco_massari11</a>&nbsp;,</P><P>you should run something ike this (if the search is only on index, host, source and sourcetype</P><LI-CODE lang="markup">| tstats count WHERE index=your_index BY host | append [ | inputlookup your_lookup.csv | eval count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>If you have to use a more comples search, you can use</P><LI-CODE lang="markup">&lt;your_search&gt; | stats count BY host | append [ | inputlookup your_lookup.csv | eval count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 07 Jun 2024 15:03:58 GMT https://community.splunk.com/t5/Splunk-Search/Alert-for-specific-missing-events/m-p/690020#M235060 gcusello 2024-06-07T15:03:58Z