Splunk Host Reporting

[ssahil]

I am looking for a Query where we can set up monitoring and alert  which can tell us how many Host are Reporting and Non Reporting accordingly alert is set up.

Sources are not Reporting from last 24 hours need to set up alert.

Can you Please assist.

[gjanders]

From community slack!missinghosts 

There are a lot of options for finding hosts or sources that stop submitting events: 

Meta Woot! https://splunkbase.splunk.com/app/2949/ 

TrackMe https://splunkbase.splunk.com/app/4621/ 

Broken Hosts App for Splunk https://splunkbase.splunk.com/app/3247/ 

Alerts for Splunk Admins ("ForwarderLevel" alerts) https://splunkbase.splunk.com/app/3796/ 

Monitoring Console https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring 

Deployment Server https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde... 

Some helpful posts: 

https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe 

https://www.duanewaddle.com/proving-a-negative/

[ITWhisperer]

If you know all the hosts you are expecting to "report", search the indexes in the last 24 hours and see which ones don't have any results. Do you have a list of hosts in a lookup?

[ssahil]

No We don't have list of Lookup file.

Can you help the Query to extract the data 

[ITWhisperer]

| stats latest(_time) as lastreport by host