How to create search to find the dates where the host is not sending logs to splunk?

[Roy_9]

Hello,

I am trying to find the dates  when the host stopped sending logs to splunk in the last 6 months.I have used the below search but can only find the earliest and latest indexed time.

Just wanted to know the dates as well when the host stopped sending logs.

| tstats count as totalcount earliest(_time) as firstTime latest(_time) as lastTime where index=linux host=xyz by host
| fieldformat firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S")
| fieldformat lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")


Thanks

[ITWhisperer]

Try something like this

| metasearch index=linux
| timechart count by host useother=f
| untable _time host count
| where count=0

[Roy_9]

Hello @ITWhisperer 

I added the host name to the query provided and ran a search but i am not seeing any results under statistics tab. Is result=0 means that the host is reporting and that is the reason we are not seeing results?

Can you please confirm?

Thanks

[ITWhisperer]

Correct - if you are getting no results, all the hosts are reporting in the time period of your search.

[PickleRick · Accepted solution]

What do you mean by "added"? @ITWhisperer 's search should be run on its own, not added to your search.

Alternatively, you can try to count splitting by time so you can limit your search to a particular month or week (I think with a day resolution it could still run but go more densely and you won't visualize it reasonably).

| tstats prestats=t count where index=<your_index> host=<your_host> by _time span=1w
| timechart span=1w count