Splunk Search

How to find the missing source


We are receiving various logs from many components. How to build a query to find the missing source.
I got the answer through lookup for unique logs such as /var/adm/corn.log ; /app/abc/srt.log
[By comparing the source in events against lookup values]

But Im not getting for the source which are using wildcards
For e.g Application app01 will have two host. Each having various logs
host1 - /app/abc/.log
host2- /app/cd/
.log, /app/bcd/*.log

How to check these wildcard using sources with standard ones?

Any ideas?

Tags (2)
0 Karma


You can use metadata. In a new search box:

 |metasearch host=<your_hosts> | streamstats dc(host) AS src_count by source | stats max(src_count) as cnt by source | where cnt < 2

This will search the metadata for the specified hosts, count the number of hosts by source, table the information using stats, and then return the sources with < 2 hosts. Those are the sources that are missing.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.