How to list hosts with no events

Susannajuurinen · ‎03-22-2013

Hi! I'm trying to find out hosts that are not sending any data to Splunk at certain time frame. Using command "host=* | chart count by host" I can get a list of hosts with event count summary, but it doesn't show those where the value is 0. Is there a way to get a list of hosts with no events?
Thanks!

sdaniels · ‎03-22-2013

This should help. Note that when the search comes back empty you don't have any hosts that are not currently sending data during the specific time period.

http://splunk-base.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data

How to list hosts with no events

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation

How to list hosts with no events

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A