I have this task were I am successful in getting result sets from nodes that are present in my splunk instance.
How ever I can't find a way to announce in the spl syntax if the Name of the Node that doesn't exist with a Yes or no value in another field
i.e.
Node present
Appserver No
Hi @jcorcoran508,
I think that Node is the hostname or a field of each system that's sending logs.
In this way you could create a lookup (called e.g. perimeter.csv) containing all the Nodes to monitor (at least one field called e.g. Node or host, in the following example Node), then you have to run a search like this:
index=your_index
| eval Node=lower(Node)
| stats count BY Node
| append [ | inputlookup perimeter.csv | eval Node=lower(Node), count=0, | fields Node count ]
| stats sum(count) AS total BY Node
| eval present=if(total=0,"No","Yes")
| table Node present
Ciao.
Giuseppe
Hi @jcorcoran508,
I think that Node is the hostname or a field of each system that's sending logs.
In this way you could create a lookup (called e.g. perimeter.csv) containing all the Nodes to monitor (at least one field called e.g. Node or host, in the following example Node), then you have to run a search like this:
index=your_index
| eval Node=lower(Node)
| stats count BY Node
| append [ | inputlookup perimeter.csv | eval Node=lower(Node), count=0, | fields Node count ]
| stats sum(count) AS total BY Node
| eval present=if(total=0,"No","Yes")
| table Node present
Ciao.
Giuseppe
Hi @jcorcoran508,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉