Finding missing events

[mcantrell]

For instance, let's say I have a list of IP addresses that I expect should show up in an FTP log each day. If I don't see any activity for a few days, I want to report/alert on that. I know that seems a little bit out of the normal splunk use case but I'm wondering if it can be done.

It would seem that I need to get splunk to understand which IP addresses I expect before I can join it to a search which has the extracted IP. What's the best way of defining these IP addresses?

I've tried creating an XML web service which is consumed as a scripted input. I've been able to extract the fields with spath expressions but I'm not sure how to take the fields and join them to another search. Does this seem like a reasonable approach or am I over complicating this? I have a tendency to do that 😉

[sdaniels · Accepted solution]

A look up will probably work best. You can just list the IP addresses in a .csv file.

http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups

http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources#Exampl...

[mcantrell]

Thanks. This gives me a good place to start.