How to create a query that lists those switches not reporting to be able to create a dashboard

[waJesu]

I have a list of switches on our network and once in a while some of them stop reporting to Splunk. I need a query that lists those switches not reporting to be able to create a dashboard

[gcusello]

Hi @waJesu,

many of these devices send very few logs to Splunk so it isn't so easy define when there's a problem.

Anyway, if you have a list of these devices to monitor, you have to put all their hostnames in a lookup (called e.g. perimeter.csv) containing one column (called e.g. host, but it isn't a problem to use adifferent filename).

Then you have to run a search like this:

| metasearch index=your_index
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

where "your_index" is the index where you are storing the logs from your devices.

Ciao.

Giuseppe