Splunk Search

Validating if 100 nodes are on boarded in splunk indexes or not. If not ?

jcorcoran508
Path Finder

I have this task were I am successful in getting result sets from nodes that are present in my splunk instance.

How ever I can't find a way to announce in the spl syntax if the Name of the Node that doesn't exist with a Yes or no value in another field

i.e.

Node            present

Appserver   No

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @jcorcoran508,

I think that Node is the hostname or a field of each system that's sending logs.

In this way you could create a lookup (called e.g. perimeter.csv) containing all the Nodes to monitor (at least one field called e.g. Node or host, in the following example Node), then you have to run a search like this:

index=your_index
| eval Node=lower(Node)
| stats count BY Node
| append [ | inputlookup perimeter.csv | eval Node=lower(Node), count=0, | fields Node count ]
| stats sum(count) AS total BY Node
| eval present=if(total=0,"No","Yes")
| table Node present

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi @jcorcoran508,

I think that Node is the hostname or a field of each system that's sending logs.

In this way you could create a lookup (called e.g. perimeter.csv) containing all the Nodes to monitor (at least one field called e.g. Node or host, in the following example Node), then you have to run a search like this:

index=your_index
| eval Node=lower(Node)
| stats count BY Node
| append [ | inputlookup perimeter.csv | eval Node=lower(Node), count=0, | fields Node count ]
| stats sum(count) AS total BY Node
| eval present=if(total=0,"No","Yes")
| table Node present

Ciao.

Giuseppe

0 Karma

gcusello
Legend

Hi @jcorcoran508,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...