How to create a script that will help me to know each devices that are not sending logs?

[pacifikn]

Greetings!

Kindly Dear Team, Kindly help on how to create a script / Alert in Splunk that will help me to know the devices that are not sending logs?

I usually use query to know the device that are not sending logs but i need that we could get message alert for each device that are not sending logs.

>Manually:

index: xxx   earliest=1 | stats latest(_time) as _time count by host.

I would like to get the alert or if there's another way I get alert all the devices that are not sending logs/receiving its logs. kindly help me?

Thank you in advance.

[gcusello]

Hi @pacifikn,

if you see in the Monitoring Console, you can find this search.

Anyway, if you want your own, you should create a lookup (called e.g. perimeter.csv) containing the list of hosts to monitor (aftel I'll describe this point) and run a search like this:

| metasearch index=_internal 
| eval host=lower(host)
| stats count BY host
| appemd [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

About the perimeter.csv lookup, you can manually manage it (and I hint this) or automatically rebuild every night scheduling a search.

Ciao.

Giuseppe