How to check which all logs are getting ingested and if there are any gaps in it?

[SonakshiRaiTH]

Hi,

I have to do gap analysis on splunk 

in order to check which all logs are getting ingested and if there are any gaps in it

Please help

Thanks,

SR

[gcusello]

Hi @SonakshiRaiTH,

you have to list all the sourcetypes you're waiting for, puth them in a lookup (called e.g. sourcetypes.csv, containing at least one column called sourcetype) and run a simple search like this:

| metasearch index=*
| eval sourcetype=lower(sourcetype), type="index"
| stats count BY sourcetype
| append [ | inputlookup sourcetypes.csv | eval sourcetype=lower(sourcetype), count=0, type="loookup" | fields sourcetype count type ]
| stats sum(count) AS total dc(type) AS dc_type values(index) AS index values(type) AS type BY sourcetype
| eval status=if(dc_type=2,"Both Indexes and lookup",if(total=0,"Only lookup","Only Indexes: ".index))
| table sourcetype status

Ciao.

Giuseppe