How to create a search to find expected hosts that are not reporting to Splunk?

[SecurityIsMyMid]

I'm looking to create a report that finds expected hosts not reporting to Splunk without using the Macro. Anyone have any suggestions?

TIA

[woodcock]

Run this search once by hand for ALL TIME

| tstats values(host) AS host WHERE index=* OR index=_* | outputcsv MyHostList.csv

Schedule this to run at least once every day:

| inputcsv MyHostList.csv | append [| tstats values(host) AS host WHERE index=* OR index=_*] | stats values(host) AS host | outputcsv MyHostList.csv

Then run this search as an alert:

| tstats values(host) AS host WHERE index=* OR index=_*  | eval dataset="current" | appendpipe [|inputcsv MyHostList.csv | eval dataset="expected"] | stats dc(dataset) AS numDatasets values(dataset) AS dataset BY host | where numDatasets=1 AND dataset="expected"

[somesoni2]

Do you have list of expected hosts somewhere in Splunk?

[SecurityIsMyMid]

Basically have a list and it is populating in Incident Review. Im looking to customize the report without the macro Splunk uses

[SecurityIsMyMid]

Yes, I have an asset list and a populated is_expected field for assets