Getting Data In
Highlighted

How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

New Member

This is the sample of the event field, start from EID are the data ingest from app, how can I get the output in last 3 days the hostname do not have any event come in the Splunk

2019-03-12 08:25:57 EID="267252209", EDT="2019-03-12 08:25:57.0", RULE_NAME="RULE1", HOSTADDR="1.1.1.1", HOSTAME="SERVER1"
Tags (2)
0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

Motivator

If I understand your query correctly you want to have a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?
To achieve this you first need to have a list of all hosts you are expecting to send, so you have the values to compare against. Then you can write a query to show you all hosts that have not reported.

I assume, your events have extracted fieldnames here (if not, please advise), and you have created a lookup CSV containing all hostnames you expect. Your query then would look like this:

 | inputlookup yourhostnames.csv | search NOT [search <your_base_query_returning_the_events> earliest=-3d | dedup HOSTNAME | table HOSTNAME]
0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

New Member

all the event send to this index and source, I don't want compare just look up existing event "HOSTNAME" and output the "HOSTNAME" no event more than 3 days

index=sec sourcetype="secevent"

0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

Ultra Champion

Hi,

You can use the metadata from your deployment to find hosts which have previously sent events, but have not done so recently

| metadata type=hosts index=_internal | eval oldest=now()-lastTime | where oldest>86400*3

You may want to run this over a long time period, such as 30 days - this will show you hosts which have sent you something in the last month, but NOT in the last 3 days.

0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

New Member

I search all time but no result display

0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

Ultra Champion

Do you have access to _internal?

0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

New Member

I'm using the relevant index name and sourcetype for my env

| metadata type=secevent index=sec l | eval oldest=now()-lastTime | where oldest>86400*3
0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

Ultra Champion

you cant specify type in a metadata search, only metadata that was created at indextime.

Try:
| metadata type=hosts index=sec | eval oldest=now()-lastTime | where oldest>86400*3

0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

New Member

Anyone can help?

0 Karma
Highlighted

Re: How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

Ultra Champion

I just added a comment below, please try that and let me know how you get on.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.