How to find non-monitored hosts

[Muthu_Vinith]

Hey All, 

I’m a splunk beginner I'm looking to create a query that to be used  as an alert, specifically to identify servers not in the _inventory – those not being monitored by Splunk. If anyone could share insights, examples

Thank You

[ITWhisperer]

Splunk is not good at finding things that aren't there - essentially, you would have to provide a list of all the servers you expect to find and discount all those that you do find, leaving you a list of servers which haven't been found.

[Muthu_Vinith]

I’ve a scenario where I want to compare of events from index=abc host=_inventory and  data from a lookup file that includes fields such as host, location, os, etc. The end goal is to point out servers that aren't being reported by Splunk. The structure of my Splunk events includes fields like location, tier, servers, and splunk_server. In the lookup file, I have fields like host, location, os, and more

I combined two data’s and what is the search condition to find out how servers are being monitored @ITWhisperer @PickleRick 

[ITWhisperer]

index=abc
| stats count by host
| inputlookup append=t yourlookup
| fillnull count
| stats sum(count) as count by host
| where count=0

[Muthu_Vinith]

This search will give results of servers that is not being reported Correct? @ITWhisperer 

[ITWhisperer]

That's the idea - try it and see

[Muthu_Vinith]

I tired this method but it's giving me servers that is  monitored @ITWhisperer 

[ITWhisperer]

This sounds like a data issue - you should check which hosts are coming up as not being monitored and see why they are not showing up in your index.

[Muthu_Vinith]

Sure @ITWhisperer 

[Muthu_Vinith]

Okay Thank you @ITWhisperer 

[PickleRick]

In splunk terminolgy it's not called "query" but "search".

Anyway, it's a common question how to "find" something that's not there.

See https://www.duanewaddle.com/proving-a-negative/