topic Re: We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging in Splunk Search

We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

Splunker6789 — Mon, 17 Jul 2017 13:44:11 GMT

We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

Re: We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

woodcock — Mon, 17 Jul 2017 14:20:47 GMT

That is a pretty vague question so the best we can do is give you similarly vague help. Start here:
https://www.splunk.com/blog/2012/10/02/tips-and-tricks-for-the-new-guy.html
https://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Usebtooltotroubleshootconfigurations

Re: We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

Splunker6789 — Mon, 17 Jul 2017 15:47:40 GMT

Pardon me .What exactly I meant to ask is We have list of hosts not reporting in splunk .I am looking for best search to find out in UI why they are not reporting .

Re: We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

woodcock — Mon, 17 Jul 2017 17:14:41 GMT

Start with the links above. If you get hung up, add a comment here.

Re: We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

JDukeSplunk — Mon, 17 Jul 2017 17:18:32 GMT

I would start with this and see if they are even talking to the indexers at all.

index=_internal source=*splunkd.log host=(YOURHOST)

If this returns no results, there is no transmission. In that case, check the that the service is started, that the port is open. Then check the $splunkhome$/var/log/splunk/splunkd.log for clues.

If there is communication, chances are you don't have any apps in place in $splunkhome$/etc/apps.

Splunk is running, but hasn't been told what to do.

Re: We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

sbbadri — Tue, 29 Sep 2020 14:55:37 GMT

Try this search on your DS,

Re: We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

Splunker6789 — Mon, 17 Jul 2017 18:23:07 GMT

Thanks ! sbbadri

Re: We have list of hots not logging lookup hosts list can any one help with search to search in splunk find out why they are not logging

Splunker6789 — Tue, 25 Jul 2017 18:39:11 GMT

Thanks!jduke