Splunk Search

How to create a search to find expected hosts that are not reporting to Splunk?

SecurityIsMyMid
Explorer

I'm looking to create a report that finds expected hosts not reporting to Splunk without using the Macro. Anyone have any suggestions?

TIA

0 Karma

woodcock
Esteemed Legend

Run this search once by hand for ALL TIME

| tstats values(host) AS host WHERE index=* OR index=_* | outputcsv MyHostList.csv

Schedule this to run at least once every day:

| inputcsv MyHostList.csv | append [| tstats values(host) AS host WHERE index=* OR index=_*] | stats values(host) AS host | outputcsv MyHostList.csv

Then run this search as an alert:

| tstats values(host) AS host WHERE index=* OR index=_*  | eval dataset="current" | appendpipe [|inputcsv MyHostList.csv | eval dataset="expected"] | stats dc(dataset) AS numDatasets values(dataset) AS dataset BY host | where numDatasets=1 AND dataset="expected"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do you have list of expected hosts somewhere in Splunk?

0 Karma

SecurityIsMyMid
Explorer

Basically have a list and it is populating in Incident Review. Im looking to customize the report without the macro Splunk uses

0 Karma

SecurityIsMyMid
Explorer

Yes, I have an asset list and a populated is_expected field for assets

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...