Splunk Search

Lookup search - display events which aren't matching

nebel
Communicator

Hi there,

I want to check, which System aren't having forwarders installed.
I am using the 'all_forwarder' search macro which comes with the Deployment Monitor App.
With this macro search I get all Forwarders.

So on the one hand there is a lookup file with all servers in my landscape. On the other hand I have 'all_forwarder' macro which displays all forwarders.

Now I want to check the lookup against the 'all_forwader' macro.
The result should list all servers which are not matching with the Hostlist from the 'all forwarder'

lookup : all_servers
fields with the server host : sourceHost

macro search: all_forwarders
fields with the forwarder hosts : sourceHost

Thanks in advance

Regards

Tags (4)
0 Karma
1 Solution

Ayn
Legend

This should do it, if I understood your question correctly:

| inputlookup all_servers | search NOT [search `all_forwarders` | fields sourceHost]

View solution in original post

0 Karma

Ayn
Legend

This should do it, if I understood your question correctly:

| inputlookup all_servers | search NOT [search `all_forwarders` | fields sourceHost]
0 Karma

nebel
Communicator

thank you very much!

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...