How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

[francly]

This is the sample of the event field, start from EID are the data ingest from app, how can I get the output in last 3 days the hostname do not have any event come in the Splunk

2019-03-12 08:25:57 EID="267252209", EDT="2019-03-12 08:25:57.0", RULE_NAME="RULE1", HOSTADDR="1.1.1.1", HOSTAME="SERVER1"

[francly]

Anyone can help?

[francly]

Anyone can help?

[nickhills]

I just added a comment below, please try that and let me know how you get on.

[nickhills]

Hi,

You can use the metadata from your deployment to find hosts which have previously sent events, but have not done so recently

| metadata type=hosts index=_internal | eval oldest=now()-lastTime | where oldest>86400*3

You may want to run this over a long time period, such as 30 days - this will show you hosts which have sent you something in the last month, but NOT in the last 3 days.

[francly]

I search all time but no result display

[ddrillic]

Do you have access to _internal?

[francly]

I'm using the relevant index name and sourcetype for my env

| metadata type=secevent index=sec l | eval oldest=now()-lastTime | where oldest>86400*3

[nickhills]

you cant specify type in a metadata search, only metadata that was created at indextime.

Try:
| metadata type=hosts index=sec | eval oldest=now()-lastTime | where oldest>86400*3

[DMohn]

If I understand your query correctly you want to have a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?
To achieve this you first need to have a list of all hosts you are expecting to send, so you have the values to compare against. Then you can write a query to show you all hosts that have not reported.

I assume, your events have extracted fieldnames here (if not, please advise), and you have created a lookup CSV containing all hostnames you expect. Your query then would look like this:

 | inputlookup yourhostnames.csv | search NOT [search <your_base_query_returning_the_events> earliest=-3d | dedup HOSTNAME | table HOSTNAME]

[francly]

all the event send to this index and source, I don't want compare just look up existing event "HOSTNAME" and output the "HOSTNAME" no event more than 3 days

index=sec sourcetype="secevent"