On the one hand I am having a lookup file which contains only simple server names, for instance
From some of them I am having logs, from some of them not. The goal is to create a table which contains all my servers in the lookup file. And then I want to have a another field which contains informations about how often I've got logs from them servers.
Server A 116 Events
Server B 690 Events
Server C 0 Events
How can I realise this? I only want to see servers from my lookup file, and I also want to see if the server sends zero events.
This assumes that your lookup is called myserverlookup and that the field name in the associated csv is host.
This search tries to do things efficiently - instead of looking at all the indexes and counting up all the events - which would take a long time - it uses Splunk's internal metrics to count the events and the last time an event arrived from each host.