Splunk Search

Create dashboard for hosts that have no results from a specific sourcetype

croseberry
Engager

Hey guys I'm trying to create a dashboard that shows any host with a group of specified hosts that are not returning data from a specific source type

So what I have been trying so far to no success is 

Index=xyz Host=abc  Sourcetype=def 
|  timechart span=30min count by host
Where count < 1
usenull=f useother=f

This won't show anything because it going to have no events to report but I'm not sure how I can create a variable base upon have no results back within a specific time then do a timechart base upon the new variable by host

Unless I'm going about this completely wrong lol please help 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, an upvote would be appreciated.
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>