Splunk Search

How can I count by host?

Harish2
Path Finder
index=abc sourcetype=app_logs
|stats count as events by host, host_ip
|where events >0



 When i schedule this as alert  i am receiving alert only when there is no data in all the hosts, but  i need to get an alert if there is no data from any ONE host as well

how can i do this???


Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Harish2 ,

the correct condition is event=0 but event=0 isn't listed because there aren't events.

To do this, you need a list of all hosts to monitor in a lookup (caled e.g. perimeter.csv) containing at lease one column (host) and then running a search like this:

index=abc sourcetype=app_logs
| stats count BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host ]
| stats sum(count) AS total 
| where total=0

Ciao.

Giuseppe

 

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...