Reporting

Find a host that is reporting to one index, but not another.

lhanich1
Path Finder

I am attempting the following:

Find hosts that are logging to one index but not the other by the host field.

Use case, find hosts reporting via AWS API but are not logging host logs via OS UF.

I have tried a left join but my results are not consistent and have spent countless time trying to come to a solution.

Thanks in advance.

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this (assuming you don't need any other filter than on 'index' field to select your data

| tstats count WHERE index="AWS API index name here" OR index="OS UF index name here" by host index
| stats values(index) as indexes by host
| where mvcount(indexes)=1  AND index="AWS API index name here" 

lhanich1
Path Finder

this actually doesnt return any results for some reason, i do have other fields i am filtering on.... but i did try the query as suggested to see the outcome but no results

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What's the query you tried? Also could you share your full query with additional filters? (mast anything sensitive)

0 Karma

pkeenan87
Communicator

I am going to assume that every host that reports into the aws index should also report into the os index. Something like this could work for you

index=index_one OR index=index_two | stats dc(index) as indexes_reporting values(index) as index_names by host | where indexes_reporting=1

This should return the hosts that are only reporting into one of the two indexes. The index that they are reporting into will be in the index_names field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...