Splunk Search

How to find non-monitored hosts

Muthu_Vinith
Path Finder

Hey All, 

I’m a splunk beginner I'm looking to create a query that to be used  as an alert, specifically to identify servers not in the _inventory – those not being monitored by Splunk. If anyone could share insights, examples

Thank You

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk is not good at finding things that aren't there - essentially, you would have to provide a list of all the servers you expect to find and discount all those that you do find, leaving you a list of servers which haven't been found.

0 Karma

Muthu_Vinith
Path Finder

I’ve a scenario where I want to compare of events from index=abc host=_inventory and  data from a lookup file that includes fields such as host, location, os, etc. The end goal is to point out servers that aren't being reported by Splunk. The structure of my Splunk events includes fields like location, tier, servers, and splunk_server. In the lookup file, I have fields like host, location, os, and more

I combined two data’s and what is the search condition to find out how servers are being monitored @ITWhisperer @PickleRick 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=abc
| stats count by host
| inputlookup append=t yourlookup
| fillnull count
| stats sum(count) as count by host
| where count=0
0 Karma

Muthu_Vinith
Path Finder

This search will give results of servers that is not being reported Correct? @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That's the idea - try it and see

0 Karma

Muthu_Vinith
Path Finder

I tired this method but it's giving me servers that is  monitored @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This sounds like a data issue - you should check which hosts are coming up as not being monitored and see why they are not showing up in your index.

0 Karma

Muthu_Vinith
Path Finder

Sure @ITWhisperer 

0 Karma

Muthu_Vinith
Path Finder

Okay Thank you @ITWhisperer 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

In splunk terminolgy it's not called "query" but "search".

Anyway, it's a common question how to "find" something that's not there.

See https://www.duanewaddle.com/proving-a-negative/

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...