Query help!

[Adam1996]

Hi!

I have a splunk setup with various indexes for different things.

im trying to create a single search which will identify any of my indexes that haven’t received any new data in say the past hour or something like that.

how could this be done?

Thank you!

[saravanan90]

This may help...

| rest /services/data/indexes | rename title AS index | dedup index | eval count=0 | table index count | join type=outer index [| tstats count where (index=* OR index=_*) by index ] |search NOT index IN("_telemetry","_thefishbucket") | stats sum(count) AS count by index | eval status = case(count=0, "missing", count>0, "active") | fields - count | where status="missing"

[isoutamo]

Hi

here is couple of answers for found host/sources which have stoped sending to splunk.

There are a lot of options for finding hosts or sources that stop submitting events:
Meta Woot! https://splunkbase.splunk.com/app/2949/
TrackMe https://splunkbase.splunk.com/app/4621/
Broken Hosts App for Splunk https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts) https://splunkbase.splunk.com/app/3796/
Monitoring Console https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...Some helpful posts:
https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe
https://www.duanewaddle.com/proving-a-negative/

r. Ismo

[Adam1996]

Thanks for the reply!

I'm looking for something that could be done specifically from the search box. Would that be possible?

[isoutamo]

e.g. this https://community.splunk.com/t5/Archive/Splunk-Universal-Forwarder-monitoring/m-p/304231/highlight/t... gives your a hint how you need to create perimeter.csv where you must first store all you used/monitored indexes. Then you can modify that query e.g. like

| metasearch index=*
| stats count by index
| append [ | inputlookup Perimeter.csv | eval count=0 | fields index count] 
| stats sum(count) AS Total by index 
| where Total=0 

r. Ismo