Search to Identify when a specificy event stops sending logs to Splunk

[leandromatperei]

I have this search string to identify certain events from extensions that stopped sending logs to Splunk, The specific event is below, I saw some examples using hosts, would it be possible instead of hosts, certain fields in the log? In this specific example, the extension appears in the log, but I need to know if it is not within the 07 day period.

index = raw_ramal EXTENSION: 11111111 (That number can be changed, there are thousands of it.

The query below shows me the number of events of the extensions, but it does not help me to locate when any of them stopped having registration in the last 07 days.

index=raw_ramal "EXTENSION:"
| rex field=_raw "EXTENSION:(?<EXTENSION>\+?\d+)"
| stats count by EXTENSION

[richgalloway]

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

[leandromatperei · Accepted solution]

Thanks.

This content helped me to understand a little more, and it has to do with what I need. However, in the query that I have, I need to know only a specific list of extensions (about 250) that I need to check daily, when I set up the query below, it brought everyone, even those that are not in my spreadsheet, how can I filter to display the count only of those in my csv?

My list has 250 events, but Splunk even has extensions that are not the ones I want to filter.

earliest=-1d index=raw_ramais
| rex field=_raw "EXTENSION:(?<EXTENSION>\+?\d+)"
| stats count by EXTENSION 
| inputlookup append=true ramais.csv
| fillnull count 
| stats sum(count) as count by EXTENSION