Splunk Search

Lookup search - display events which aren't matching

nebel
Communicator

Hi there,

I want to check, which System aren't having forwarders installed.
I am using the 'all_forwarder' search macro which comes with the Deployment Monitor App.
With this macro search I get all Forwarders.

So on the one hand there is a lookup file with all servers in my landscape. On the other hand I have 'all_forwarder' macro which displays all forwarders.

Now I want to check the lookup against the 'all_forwader' macro.
The result should list all servers which are not matching with the Hostlist from the 'all forwarder'

lookup : all_servers
fields with the server host : sourceHost

macro search: all_forwarders
fields with the forwarder hosts : sourceHost

Thanks in advance

Regards

Tags (4)
0 Karma
1 Solution

Ayn
Legend

This should do it, if I understood your question correctly:

| inputlookup all_servers | search NOT [search `all_forwarders` | fields sourceHost]

View solution in original post

0 Karma

Ayn
Legend

This should do it, if I understood your question correctly:

| inputlookup all_servers | search NOT [search `all_forwarders` | fields sourceHost]
0 Karma

nebel
Communicator

thank you very much!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...