Splunk Search

Check multiple hosts for existence

seva98
Path Finder

I have list of around 100 hosts that are sending data to index and I would love to return a table with hostname and status of 0 (didn't receive any date from it in selected time range) and 1 (did receive the data).

I am able to search through multiple hosts with OR like `host=test1 OR host=test2 OR ...` but I am not sure how to display status 0 at hosts that are not found.

What would be efficient solution for this please?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
See https://www.duanewaddle.com/proving-a-negative/
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
See https://www.duanewaddle.com/proving-a-negative/
---
If this reply helps you, Karma would be appreciated.

seva98
Path Finder

Thanks Rich, that is so simple but also very scaleable solution.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...