Validating if 100 nodes are on boarded in splunk indexes or not. If not ?

[jcorcoran508]

I have this task were I am successful in getting result sets from nodes that are present in my splunk instance.

How ever I can't find a way to announce in the spl syntax if the Name of the Node that doesn't exist with a Yes or no value in another field

i.e.

Node            present

Appserver   No

[gcusello · Accepted solution]

Hi @jcorcoran508,

I think that Node is the hostname or a field of each system that's sending logs.

In this way you could create a lookup (called e.g. perimeter.csv) containing all the Nodes to monitor (at least one field called e.g. Node or host, in the following example Node), then you have to run a search like this:

index=your_index
| eval Node=lower(Node)
| stats count BY Node
| append [ | inputlookup perimeter.csv | eval Node=lower(Node), count=0, | fields Node count ]
| stats sum(count) AS total BY Node
| eval present=if(total=0,"No","Yes")
| table Node present

Ciao.

Giuseppe

[gcusello]

Hi @jcorcoran508,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉