Hi All,
I have a field name ip_address which has 50 IP values in it. at every 5mins interval, I will receive the same values.
ip_address
10.1.1.1
10.1.1.2
10.1.1.3
.
.
.
10.1.1.49
10.1.1.50
What are ways to list down the values which are not coming to splunk. Let's say 10.1.1.2 and 10.1.1.45 are not coming to splunk. Then I need those missing values to be listed in statistical way to create an alert for missing ip address.
What are ways to achieve this.
Please help 🙂 Thanks in advance.
Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/
Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/