Up Down status from a Pre Defined List

[rosha16]

Hi All,

Below is my requiremnt , I have a CSV file which is quite big but in the belwo format

Ips,Name
10.10.10.1,IndiaFW
192.168.5.6,UsFW

These Ips are sending Logs to Splunk , I want to Know which are sending Logs and which are not , The End result should look Like

Ips, Name Status
10.10.10.1 IndiaFW Up ( Sending Logs )
192.168.5.6 UsFW Down ( Not Sending Logs )

[rosha16]

Hi,

I am quite a newbee to Splunk , I can understand that you need to write a search statement , However You need tp start with a start with a soucetype ,

Can you plz explain in Lehman terms , How I can able to achive the able with a search statement

[martin_mueller]

Assuming you expect events in index foo with host=Ip, you can do something like this

| inputlookup your_file | join type=left Ips [metadata type=hosts index=foo | rename host as Ips]

and proceed from there.