Splunk IT Service Intelligence

need splunk query for this we have two hosts and we want to display the status for these two hosts (up/down) but one host is not available in the list that host we dill display it as down

New Member

one host logs are not coming in to the splunk that host we want display as a Down

Labels (1)
0 Karma

Esteemed Legend

This has been solved many times including:

Meta Woot!: https://splunkbase.splunk.com/app/2949/
TrackMe: https://splunkbase.splunk.com/app/4621/,
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...
0 Karma

Ultra Champion
| tstats count  where host="A" OR host="B" by host
| append [|makeresults
| eval host=split("A,B",",")
| mvexpand host
| fields - _*]
| stats values(count) as status by host
| fillnull value=Down
| rex field=status mode=sed "s/\d+/Up/g"
0 Karma


Sounds like you may need a lookup so you can report on what's missing.

Let's say you have a csv named important_hosts.csv with a single field named host

Now you can do something like this:

index=ndx sourcetype=srctp (host="host_1" OR host="host_2")
| stats count by host
| append
    [ | inputlookup important_hosts.csv ]
| fillnull
| stats max(count) as count by host
| eval status=if(count>0,"up","down")
| fields - count
0 Karma

New Member

Hi I tried this query but not showing the down host
And it is metric log query I searched with system.system_up_time metric log

0 Karma



Run the given query for particular time range or real-time and get count of events by host.
If count is greater than 0 than host is UP, else DOWN.

host=host_1 OR host=host_2
| stats count by host
| eval status = if(count>0, "Up", "Down")
| table host, status

accept & up-vote the answer if it helps

0 Karma


If host1 isn't sending data, stats isn't going to find it

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...