I have an input lookup called servers.csv (header is called host)
that lookup has all the servers that should be reporting into my sourcetype called: index=main sourcetype=servers
i see the host using: index=main sourcetype=servers host=server1
I need to have a report of what hosts from that CSV are not reporting into my sourcetype.
thank you very much for helping me.
Try this. This will give list of hosts from your lookup which do not have any event in
index=main sourcetype=servers for your selected time range of the query.
| tstats count WHERE index=main sourcetype=servers by host | eval isReporting=1 | append [| inputlookup servers.csv | table host | eval isReporting=0] | stats max(isReporting) as isReporting by host | where isReporting=0
Try running everything except the
| where... part. It should return results. Then see in the results if you see any row with field isReporting as 0. If they're all 1 means all the servers are reporting. Also, what time range you're using for your search?