Splunk Search

How to find the missing source


We are receiving various logs from many components. How to build a query to find the missing source.
I got the answer through lookup for unique logs such as /var/adm/corn.log ; /app/abc/srt.log
[By comparing the source in events against lookup values]

But Im not getting for the source which are using wildcards
For e.g Application app01 will have two host. Each having various logs
host1 - /app/abc/.log
host2- /app/cd/
.log, /app/bcd/*.log

How to check these wildcard using sources with standard ones?

Any ideas?

Tags (2)
0 Karma


You can use metadata. In a new search box:

 |metasearch host=<your_hosts> | streamstats dc(host) AS src_count by source | stats max(src_count) as cnt by source | where cnt < 2

This will search the metadata for the specified hosts, count the number of hosts by source, table the information using stats, and then return the sources with < 2 hosts. Those are the sources that are missing.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!