https://community.splunk.com/t5/Splunk-Search/How-find-hosts-that-are-missing-a-particular-sourcetype/m-p/192213#M55266 <P>My windows hosts should have 'WinEventLog:Security' and Script:InstalledUpdates.</P> <P>How can I search for hosts that have Script:InstalledUpdates but is missing 'WinEventLog:Security' ?</P> <P>Thank you</P> Mon, 12 Jan 2015 22:19:30 GMT omgwut56k 2015-01-12T22:19:30Z https://community.splunk.com/t5/Splunk-Search/How-find-hosts-that-are-missing-a-particular-sourcetype/m-p/192213#M55266 <P>My windows hosts should have 'WinEventLog:Security' and Script:InstalledUpdates.</P> <P>How can I search for hosts that have Script:InstalledUpdates but is missing 'WinEventLog:Security' ?</P> <P>Thank you</P> Mon, 12 Jan 2015 22:19:30 GMT https://community.splunk.com/t5/Splunk-Search/How-find-hosts-that-are-missing-a-particular-sourcetype/m-p/192213#M55266 omgwut56k 2015-01-12T22:19:30Z https://community.splunk.com/t5/Splunk-Search/How-find-hosts-that-are-missing-a-particular-sourcetype/m-p/192214#M55267 <P>Try this:</P> <PRE><CODE>| tstats values(sourcetype) as sourcetypes where index=yourindex by host | search sourcetypes="Script:InstalledUpdates" NOT sourcetypes="WinEventLog:Security" </CODE></PRE> Mon, 12 Jan 2015 23:21:29 GMT https://community.splunk.com/t5/Splunk-Search/How-find-hosts-that-are-missing-a-particular-sourcetype/m-p/192214#M55267 martin_mueller 2015-01-12T23:21:29Z https://community.splunk.com/t5/Splunk-Search/How-find-hosts-that-are-missing-a-particular-sourcetype/m-p/192215#M55268 <P>Thank you!</P> Tue, 13 Jan 2015 14:11:37 GMT https://community.splunk.com/t5/Splunk-Search/How-find-hosts-that-are-missing-a-particular-sourcetype/m-p/192215#M55268 omgwut56k 2015-01-13T14:11:37Z