https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135237#M36984 <P>Hi all,</P> <P>I am a new one to splunk. Now i am facing some problem to get the data as I want. <BR /> I have more than 250 servers forwarding data to splunk, and the events are updated every hour as a group. For example, each server will sent the total number of interaction for the last hour. now I want to find every server name which has not sent data for the last 4 hours. <BR /> When I search the event, if there is no data sending, then the server name will not display after search, so I can't get them. My question is how can I get all server names and then find out those who are no longer sending. Please kindly help me on this.<BR /> My base search: </P> <PRE><CODE> interaction_count="*" LIVE| eval date = strftime(_time, "%Y-%m-%d")| stats sum(interaction_count) as sum_interaction_count by mount_name, date </CODE></PRE> <P>Thanks in advance~~~</P> Thu, 04 Jun 2015 01:38:18 GMT tenyang 2015-06-04T01:38:18Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135237#M36984 <P>Hi all,</P> <P>I am a new one to splunk. Now i am facing some problem to get the data as I want. <BR /> I have more than 250 servers forwarding data to splunk, and the events are updated every hour as a group. For example, each server will sent the total number of interaction for the last hour. now I want to find every server name which has not sent data for the last 4 hours. <BR /> When I search the event, if there is no data sending, then the server name will not display after search, so I can't get them. My question is how can I get all server names and then find out those who are no longer sending. Please kindly help me on this.<BR /> My base search: </P> <PRE><CODE> interaction_count="*" LIVE| eval date = strftime(_time, "%Y-%m-%d")| stats sum(interaction_count) as sum_interaction_count by mount_name, date </CODE></PRE> <P>Thanks in advance~~~</P> Thu, 04 Jun 2015 01:38:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135237#M36984 tenyang 2015-06-04T01:38:18Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135238#M36985 <P>One thing need mention is that, if there is no interaction in 1 hour, it still send a event, but the sum(interaction_count) is 0. Now I want to find out no data reporting screen, <STRONG>which shows blank not 0</STRONG> if we show one day event by hour.</P> Thu, 04 Jun 2015 01:43:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135238#M36985 tenyang 2015-06-04T01:43:41Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135239#M36986 <P>Run something like this every hour for the last 24 hours as an Alert:</P> <PRE><CODE>.... | stats latest(_time) AS lastReportTime BY mount_name | eval silenceSeconds = now() - lastReportTime | where silenceSeconds &gt; 14400 </CODE></PRE> Thu, 04 Jun 2015 13:32:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135239#M36986 woodcock 2015-06-04T13:32:49Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135240#M36987 <P>Here you go!</P> <PRE><CODE>interaction_count="*" LIVE|bucket _time span=4h| eval date = strftime(_time, "%Y-%m-%d")| stats sum(interaction_count) as sum_interaction_count by mount_name, date|where sum_interaction_count=0 </CODE></PRE> Thu, 04 Jun 2015 14:05:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135240#M36987 stephanefotso 2015-06-04T14:05:02Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135241#M36988 <P>Thanks so much Woodcock, it works!!</P> Fri, 05 Jun 2015 06:04:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135241#M36988 tenyang 2015-06-05T06:04:25Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135242#M36989 <P>Thanks for your help Stephanefotso.</P> Fri, 05 Jun 2015 06:05:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-name-of-each-server-that-has/m-p/135242#M36989 tenyang 2015-06-05T06:05:09Z