Dashboards & Visualizations

Finding missing events

Explorer

For instance, let's say I have a list of IP addresses that I expect should show up in an FTP log each day. If I don't see any activity for a few days, I want to report/alert on that. I know that seems a little bit out of the normal splunk use case but I'm wondering if it can be done.

It would seem that I need to get splunk to understand which IP addresses I expect before I can join it to a search which has the extracted IP. What's the best way of defining these IP addresses?

I've tried creating an XML web service which is consumed as a scripted input. I've been able to extract the fields with spath expressions but I'm not sure how to take the fields and join them to another search. Does this seem like a reasonable approach or am I over complicating this? I have a tendency to do that 😉

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee
0 Karma

Splunk Employee
Splunk Employee
0 Karma

Explorer

Thanks. This gives me a good place to start.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!