Splunk Search

Create dashboard for hosts that have no results from a specific sourcetype

croseberry
Engager

Hey guys I'm trying to create a dashboard that shows any host with a group of specified hosts that are not returning data from a specific source type

So what I have been trying so far to no success is 

Index=xyz Host=abc  Sourcetype=def 
|  timechart span=30min count by host
Where count < 1
usenull=f useother=f

This won't show anything because it going to have no events to report but I'm not sure how I can create a variable base upon have no results back within a specific time then do a timechart base upon the new variable by host

Unless I'm going about this completely wrong lol please help 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...