https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248195#M74051 <P>Hi sravankaripe,<BR /> If you want to know host that don't send log the solution from @sundareshr is perfect.<BR /> If you want to have a table with all the host and the indication of which are sending and which aren't sending you could use something like this:<BR /> |inputlookup hoslist.csv | eval count=0, host=lower(host) | append [ search index=_internal | eval host=lower(host) | stats count by host ] | stats sum(count) AS Total | rangemap field=Total severe=0-0 low=1-1000000000 default=severe <BR /> In this way hosts with severe aren't sending and host with low are sending.<BR /> You could also add a graphical representation using </P> <PRE><CODE>script="table_icons_rangemap.js, stylesheet="table_decorations.css" </CODE></PRE> <P>that you can take from the Splunk 6.0 Dashboard Examples App (<A href="https://splunkbase.splunk.com/app/1603/">https://splunkbase.splunk.com/app/1603/</A>).</P> <P>Bye.<BR /> Giuseppe</P> Tue, 29 Nov 2016 09:41:25 GMT gcusello 2016-11-29T09:41:25Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248192#M74048 <P>how can i know that a particular host is sending data or not? and how can i know that the Splunk agent is installed in particular host or not? please help me with search query and what we have to observer from the search result.</P> Mon, 28 Nov 2016 15:35:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248192#M74048 sravankaripe 2016-11-28T15:35:21Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248193#M74049 <P>i know index=_internal sourcetype=splunkd</P> Mon, 28 Nov 2016 15:37:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248193#M74049 sravankaripe 2016-11-28T15:37:55Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248194#M74050 <P>You will first need to create a list of all the hosts in your environment and use that to create a lookup file (csv file should have a field called host)</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Lookup">http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Lookup</A></P> <P>ONce you have the lookup, you try this search</P> <PRE><CODE>| inputlookup hostlist.csv | field host | search NOT [| metadata type=hosts index=*] </CODE></PRE> Mon, 28 Nov 2016 22:37:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248194#M74050 sundareshr 2016-11-28T22:37:45Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248195#M74051 <P>Hi sravankaripe,<BR /> If you want to know host that don't send log the solution from @sundareshr is perfect.<BR /> If you want to have a table with all the host and the indication of which are sending and which aren't sending you could use something like this:<BR /> |inputlookup hoslist.csv | eval count=0, host=lower(host) | append [ search index=_internal | eval host=lower(host) | stats count by host ] | stats sum(count) AS Total | rangemap field=Total severe=0-0 low=1-1000000000 default=severe <BR /> In this way hosts with severe aren't sending and host with low are sending.<BR /> You could also add a graphical representation using </P> <PRE><CODE>script="table_icons_rangemap.js, stylesheet="table_decorations.css" </CODE></PRE> <P>that you can take from the Splunk 6.0 Dashboard Examples App (<A href="https://splunkbase.splunk.com/app/1603/">https://splunkbase.splunk.com/app/1603/</A>).</P> <P>Bye.<BR /> Giuseppe</P> Tue, 29 Nov 2016 09:41:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-let-me-know-if-Splunk-is/m-p/248195#M74051 gcusello 2016-11-29T09:41:25Z