https://community.splunk.com/t5/Splunk-Search/How-to-find-the-missing-source/m-p/136335#M37286 <P>You can use metadata. In a new search box:</P> <PRE><CODE> |metasearch host=&lt;your_hosts&gt; | streamstats dc(host) AS src_count by source | stats max(src_count) as cnt by source | where cnt &lt; 2 </CODE></PRE> <P>This will search the metadata for the specified hosts, count the number of hosts by source, table the information using stats, and then return the sources with &lt; 2 hosts. Those are the sources that are missing.</P> Tue, 23 Sep 2014 16:17:49 GMT alacercogitatus 2014-09-23T16:17:49Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-missing-source/m-p/136334#M37285 <P>We are receiving various logs from many components. How to build a query to find the missing source.<BR /> I got the answer through lookup for unique logs such as /var/adm/corn.log ; /app/abc/srt.log <BR /> [By comparing the source in events against lookup values]</P> <P>But Im not getting for the source which are using wildcards<BR /> For e.g Application app01 will have two host. Each having various logs<BR /> host1 - /app/abc/<EM>.log<BR /> host2- /app/cd/</EM>.log, /app/bcd/*.log</P> <P>How to check these wildcard using sources with standard ones?</P> <P>Any ideas?</P> Tue, 23 Sep 2014 11:17:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-missing-source/m-p/136334#M37285 splunkn 2014-09-23T11:17:42Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-missing-source/m-p/136335#M37286 <P>You can use metadata. In a new search box:</P> <PRE><CODE> |metasearch host=&lt;your_hosts&gt; | streamstats dc(host) AS src_count by source | stats max(src_count) as cnt by source | where cnt &lt; 2 </CODE></PRE> <P>This will search the metadata for the specified hosts, count the number of hosts by source, table the information using stats, and then return the sources with &lt; 2 hosts. Those are the sources that are missing.</P> Tue, 23 Sep 2014 16:17:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-missing-source/m-p/136335#M37286 alacercogitatus 2014-09-23T16:17:49Z