Search help please

[surajsplunkd]

Good morning!! I am a Beginner in Splunk, below query only tell me whether HF is DOWN or HEALTHY.

++++++++++++++++++++++++++++++

`internal` source="/opt/splunk/var/log/splunk/metrics.log" fwdType=full | search NOT hostname=*cbl* NOT hostname=*cwn* NOT hostname=*SCO* NOT hostname=*SGW* NOT hostname=*spft* NOT hostname=*tsps* NOT hostname=*psps* NOT hostname=*puba* NOT hostname=aue11pspf001* NOT hostname=aue12pspf001*| dedup hostname | stats count as historic_count | appendcols [search `internal` source="/opt/splunk/var/log/splunk/metrics.log" fwdType=full earliest=-5m latest=now | search NOT hostname=*cbl* NOT hostname=*cwn* NOT hostname=*SCO* NOT hostname=*SGW* NOT hostname=*spft* NOT hostname=*tsps* NOT hostname=*psps* NOT hostname=*puba* NOT hostname=aue11pspf001* NOT hostname=aue12pspf001*| dedup hostname | stats count as recent_count] | eval count = historic_count - recent_count | rangemap field=count low=0-0 severe=1-100 | eval health = if(count>0, "HF DOWN", "HEALTHY") | eval count = health | table count health range

++++++++++++++++++++++++

Could you please help me modify this to find which HOST is DOWN?

Immediate response is highly appreciated.

Thanks, in advance.

[isoutamo]

Hi

There are several ways to do it. You could add all your HF on MC as on indexers and create own custom groups for them. Then MC monitor those and alert you when any of those has issues. 
Another way is e.g. use this kind of solution https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Universal-Forwarder-monitoring/m-p/304230 . You need to modify your original query by adding this Perimeter.csv  part instead of what you have starting appendcols. Then your need another Savedsearch to update that Perimeter.csv time by time.

r. Ismo