https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-return-hosts-that-are-not-sending/m-p/230444#M68315 <PRE><CODE>|tstats count WHERE index=wineventlog groupby host sourcetype | chart sum(count) over host by sourcetype | addtotals | search Total&gt;0 NOT WinEventLog:Security&gt;1 </CODE></PRE> <P>I had to use the <CODE>NOT WinEventLog:Security&gt;1</CODE> as <CODE>isnull</CODE> and <CODE>=0</CODE>, <CODE>="0"</CODE>, and <CODE>&lt;1</CODE> all did not work.</P> Tue, 03 May 2016 22:26:03 GMT willamwar 2016-05-03T22:26:03Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-return-hosts-that-are-not-sending/m-p/230443#M68314 <P>I want to get a list of all hosts not sending "WinEventLog:Security".<BR /><BR /> So <CODE>index=wineventlog</CODE>, get list of hosts, remove any that have reported "WinEventLog:Security"</P> <P>How can I do this?</P> Tue, 03 May 2016 22:25:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-return-hosts-that-are-not-sending/m-p/230443#M68314 willamwar 2016-05-03T22:25:36Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-return-hosts-that-are-not-sending/m-p/230444#M68315 <PRE><CODE>|tstats count WHERE index=wineventlog groupby host sourcetype | chart sum(count) over host by sourcetype | addtotals | search Total&gt;0 NOT WinEventLog:Security&gt;1 </CODE></PRE> <P>I had to use the <CODE>NOT WinEventLog:Security&gt;1</CODE> as <CODE>isnull</CODE> and <CODE>=0</CODE>, <CODE>="0"</CODE>, and <CODE>&lt;1</CODE> all did not work.</P> Tue, 03 May 2016 22:26:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-return-hosts-that-are-not-sending/m-p/230444#M68315 willamwar 2016-05-03T22:26:03Z