Checking specific index data for large server list

[nehamvinchankar]

Hi all,

I have list of 3k+ servers for which i want to check data flow from specific index. How can i do this with optimize search

[gcusello]

Hi @nehamvinchankar,

you could insert the server list in a lookup (called e.g. "perimeter.csv"9 containing at least one column (host).

Remember to create also the lookup definition.

then you could run a search like this:

| tstats count WHERE index=your_index BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

Ciao.

Giuseppe

[nehamvinchankar]

Not working

I want list of servers which are having index data from the list provided

[gcusello]

Hi @nehamvinchankar,

sorry, this is the check that all the servers are sending data.

If you want the server list that sent data is easier, try this:

| tstats count WHERE index=your_index BY host
| table host

Ciao.

Giuseppe