InputLookup to monitor data inputs

[DaveBunn]

I have a lookup file called TA_feeds.csv with six columns labeled below with multiple rows similar to the one below.

index | sourcetype | source | period | App | Input

Azure | mscs:Azure:VirtualMachines | /subscription/1111-2222-3333-4444/* | 42300 | SPlunk_Cloud | AZ_VM_Feeds

AD | Azure:Signin | main_tenant | 360 | Azure_App | AD_SignIn

I use the SPL

[| inputlookup TA_feeds.csv | eval earliest=0-period."s" |  fields index sourcetype source earliest | format]

| stats count by index sourcetype source

which iterates through the the lookup, and searches the relevant indexes for the data  one row at a time and generates a count for each input type.

The problem is - if a row in the lookup does not generate any data - then there is not an entry in the stats.

What I need is to be able to show if a feed is zero -i.e. | search count=0
But can't figure out how to generate the zero entries

[gcusello]

Hi @DaveBunn ,

you have the same problem taking events from a data source: if you don't have events, you don't have any count in the stats.

At first you have to define what you want to monitor: hosts, indexes, sourcetypes.

Then, defined what to monitor (e.g. sourcetypes), you have to create anothe lookup (called e.g. perimeter.csv) containing all the values of the field to monitor at least in one column (e.g. sourcetype).

then you could run something like this:

| inputlookup TA_feeds.csv
! stats count BY sourcetype
| append [ | inputlookup perimeter.csv | eval count=0 | fields sourcetype count ]
| stats sum(count) AS total BY sourcetype
| eval status=if(total=0,"Not Present","Present")
| table sourcetype status

In this way, you have a table containing all the sourcetypes to monitor and the information if there are rows for each sourcetype or not.

Ciao.

Giuseppe