Splunk Search

Check multiple hosts for existence

seva98
Path Finder

I have list of around 100 hosts that are sending data to index and I would love to return a table with hostname and status of 0 (didn't receive any date from it in selected time range) and 1 (did receive the data).

I am able to search through multiple hosts with OR like `host=test1 OR host=test2 OR ...` but I am not sure how to display status 0 at hosts that are not found.

What would be efficient solution for this please?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
See https://www.duanewaddle.com/proving-a-negative/
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
See https://www.duanewaddle.com/proving-a-negative/
---
If this reply helps you, Karma would be appreciated.

seva98
Path Finder

Thanks Rich, that is so simple but also very scaleable solution.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...