Splunk Alert if host on lookup stops sending data

[scout29]

Looking to create an alert if a host on a lookup stops sending data to Splunk index=abc. I have created a lookup called hosts.csv with all the hosts expected to be logging for a data source. Now i need to create a search/alert that notifies me if a host on this lookup stops sending data to index=abc

I was trying something like this  search below, but now having much luck:

| tstats count where index=abc host NOT [| inputlookup hosts.csv] by host

The lookup called hosts.csv is formatted with the column name being host, for example like:

host

hostname101

hostname102

hostname103

hostname104

[gcusello · Accepted solution]

Hi @scout29 ,

please try something like this:

| tstats count where index=abc BY host 
| append [ | inputlookup hosts.csv | eval count=0 | fields host count]
| stats sum(count) AS total BY host
| where total=0

Ciao.

Giuseppe

[gcusello]

Hi @scout29 

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉