Splunk Search

How can I count by host?

Harish2
Path Finder
index=abc sourcetype=app_logs
|stats count as events by host, host_ip
|where events >0



 When i schedule this as alert  i am receiving alert only when there is no data in all the hosts, but  i need to get an alert if there is no data from any ONE host as well

how can i do this???


Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Harish2 ,

the correct condition is event=0 but event=0 isn't listed because there aren't events.

To do this, you need a list of all hosts to monitor in a lookup (caled e.g. perimeter.csv) containing at lease one column (host) and then running a search like this:

index=abc sourcetype=app_logs
| stats count BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host ]
| stats sum(count) AS total 
| where total=0

Ciao.

Giuseppe

 

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...