Splunk Search

How to create a search to find non-integrated hosts with lookup?

Communicator

Hello, I need to make a query to find from a list of hosts, which ones are still not integrated or sending data to the Splunk platform.

I already have the lookup with the total universe of hosts which should be on the platform.
Any help will be appreciated. thanks!

0 Karma

Ultra Champion
 Meta Woot!: https://splunkbase.splunk.com/app/2949/
 TrackMe: https://splunkbase.splunk.com/app/4621/,
 Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
 Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
 Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
 Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
 Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...

@woodcock recommend.

| metadata type=hosts
| inputlookup append=t your_host.csv
| where as_you_like

It works, but It's not very good.

0 Karma