Splunk Search

Check multiple hosts for existence

seva98
Path Finder

I have list of around 100 hosts that are sending data to index and I would love to return a table with hostname and status of 0 (didn't receive any date from it in selected time range) and 1 (did receive the data).

I am able to search through multiple hosts with OR like `host=test1 OR host=test2 OR ...` but I am not sure how to display status 0 at hosts that are not found.

What would be efficient solution for this please?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
See https://www.duanewaddle.com/proving-a-negative/
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
See https://www.duanewaddle.com/proving-a-negative/
---
If this reply helps you, Karma would be appreciated.

seva98
Path Finder

Thanks Rich, that is so simple but also very scaleable solution.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...