Splunk Enterprise

Search to Identify when a specificy event stops sending logs to Splunk

leandromatperei
Path Finder

I have this search string to identify certain events from extensions that stopped sending logs to Splunk, The specific event is below, I saw some examples using hosts, would it be possible instead of hosts, certain fields in the log? In this specific example, the extension appears in the log, but I need to know if it is not within the 07 day period.

 

index = raw_ramal EXTENSION: 11111111 (That number can be changed, there are thousands of it.

The query below shows me the number of events of the extensions, but it does not help me to locate when any of them stopped having registration in the last 07 days.

 

index=raw_ramal "EXTENSION:"
| rex field=_raw "EXTENSION:(?<EXTENSION>\+?\d+)"
| stats count by EXTENSION

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

leandromatperei
Path Finder

Thanks.

This content helped me to understand a little more, and it has to do with what I need. However, in the query that I have, I need to know only a specific list of extensions (about 250) that I need to check daily, when I set up the query below, it brought everyone, even those that are not in my spreadsheet, how can I filter to display the count only of those in my csv?

My list has 250 events, but Splunk even has extensions that are not the ones I want to filter.

earliest=-1d index=raw_ramais
| rex field=_raw "EXTENSION:(?<EXTENSION>\+?\d+)"
| stats count by EXTENSION 
| inputlookup append=true ramais.csv
| fillnull count 
| stats sum(count) as count by EXTENSION

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, an upvote would be appreciated.
0 Karma

leandromatperei
Path Finder

Thanks.

This content helped me to understand a little more, and it has to do with what I need. However, in the query that I have, I need to know only a specific list of extensions (about 250) that I need to check daily, when I set up the query below, it brought everyone, even those that are not in my spreadsheet, how can I filter to display the count only of those in my csv?

My list has 250 events, but Splunk even has extensions that are not the ones I want to filter.

earliest=-1d index=raw_ramais
| rex field=_raw "EXTENSION:(?<EXTENSION>\+?\d+)"
| stats count by EXTENSION 
| inputlookup append=true ramais.csv
| fillnull count 
| stats sum(count) as count by EXTENSION

 

0 Karma