Splunk Report to identify hosts/containers that are not reporting anything

[prachijain1288]

Hello All,

I have an inputlookup csv file that contains a list of host and corresponding docker containers running on those hosts for my environment. I am trying to generate a report where I can report daily list of host+containers that have not sent any logs to splunk for that particular day. Stats count does not return 0 event count. I am trying to get something like below:

Monday                                 Tuesday                           Wednesday                   Thursday                              Friday

host1-containerx             host3-containerx         host4-containerx.       host5-containerx              ---

host1-containery            host3-containery         host5-containerx

host2-containerz          host3-containerz

host1-containery

host2-containerz

I would appreciate any help 🙂

Thank you !!

[efavreau]

@prachijain1288  Try to search for your answer in the community to see if the question has already been asked. As ITWhisperer indicates, this comes up. A lot. Also, you want to try to tell us what you've tried, what the result was, why the result doesn't meet your expectations, and what your expectations were. This helps us figure out what a possible solution might be.

To give you one possible lead to your question, try reading this and if that doesn't help, use the link ITWhisperer created.
https://community.splunk.com/t5/Splunk-Search/Display-hosts-with-no-data/m-p/293342

[ITWhisperer]

You could start here