How do you find hosts that are not sending specific EventIDs?

New Member

I'm trying to search my log data and figure out if a list of host names are not sending specific event IDs.

I have a lookup table called audit_items.csv with the following: 4624 has data while 7777 purposely shows nothing.


My search looks like this.

| inputlookup audit_items.csv
| join type=outer EventID 
 [ search host="" 
 | stats count by EventID Hostname]
  | table Hostname, EventID count 
 | fillnull value=0 

What I would like to do is add another lookup table with a list of Hostnames so that instead of my results showing nothing for an EventID 7777 that it will also tell me each Hostname not sending each type of EventID.


Tags (1)
0 Karma


@simpsobr345 ,

Give this a try,

host="" | stats count by EventID Hostname|append [|inputlookup audit_items.csv] 
|eventstats values(Hostname) as Hostname
|stats values(Hostname) as tempHost,values(Hostname) as Hostname by EventID
|mvexpand Hostname|eval Found=mvfind(tempHost,Hostname)
|eval Found=if(isnull(Found),"No","Yes")|fields - Hostname
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...