This is the sample of the event field, start from EID are the data ingest from app, how can I get the output in last 3 days the hostname do not have any event come in the Splunk
2019-03-12 08:25:57 EID="267252209", EDT="2019-03-12 08:25:57.0", RULE_NAME="RULE1", HOSTADDR="22.214.171.124", HOSTAME="SERVER1"
If I understand your query correctly you want to have a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?
To achieve this you first need to have a list of all hosts you are expecting to send, so you have the values to compare against. Then you can write a query to show you all hosts that have not reported.
I assume, your events have extracted fieldnames here (if not, please advise), and you have created a lookup CSV containing all hostnames you expect. Your query then would look like this:
| inputlookup yourhostnames.csv | search NOT [search <your_base_query_returning_the_events> earliest=-3d | dedup HOSTNAME | table HOSTNAME]
all the event send to this index and source, I don't want compare just look up existing event "HOSTNAME" and output the "HOSTNAME" no event more than 3 days
You can use the metadata from your deployment to find hosts which have previously sent events, but have not done so recently
| metadata type=hosts index=_internal | eval oldest=now()-lastTime | where oldest>86400*3
You may want to run this over a long time period, such as 30 days - this will show you hosts which have sent you something in the last month, but NOT in the last 3 days.
I'm using the relevant index name and sourcetype for my env
| metadata type=secevent index=sec l | eval oldest=now()-lastTime | where oldest>86400*3
you cant specify
type in a metadata search, only metadata that was created at indextime.
| metadata type=hosts index=sec | eval oldest=now()-lastTime | where oldest>86400*3