Splunk Search

how to search a service that not running on certain hosts

JamesJ
Explorer

Dear Community, 

I am writing a search for windows services. I am trying to find out the number of hosts that having/not having a certain service.  

Here is the search that I have  to find out servers that having the services running: 

index=*_oswin sourcetype="WMI:Service" source="WMI:Service" Name="Appdynamics Machine Agent" | dedup host  | stats sum()
 
How can I do the second part please? Also, I want to integrate those two numbers into one pie chart. Any suggestion is highly appreicated! 
Labels (3)
Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @JamesJ,

you have to create a lookup (called e.g. perimeter.csv) containing all the monitored servers (only one column with "host").

Then you hav e to modify your search having something like this:

index=*_oswin sourcetype="WMI:Service" source="WMI:Service" Name="Appdynamics Machine Agent" 
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Not present","Present")
| stats count BY status

Ciao.

Giuseppe

View solution in original post

venkatasri
Influencer

Hi @JamesJ 

To find not running services you should have catalog list of services in a lookup or somewhere in splunk.

Can you describe what's first part, second part here that you want to see?

 

0 Karma

JamesJ
Explorer

Hi Venk,

Thanks for replying. 

The first part is to list all servers that having a particular service (e.g. Spooler) installed.

The second part is to list all servers that don't have this service installed. 

Finally, I want to put the number into a pie chart. 

Hope that makes sense. 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @JamesJ,

you have to create a lookup (called e.g. perimeter.csv) containing all the monitored servers (only one column with "host").

Then you hav e to modify your search having something like this:

index=*_oswin sourcetype="WMI:Service" source="WMI:Service" Name="Appdynamics Machine Agent" 
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Not present","Present")
| stats count BY status

Ciao.

Giuseppe

View solution in original post

JamesJ
Explorer

Hi @gcusello ,

Appreciate the hints. I will go ahead with a try with input lookup.

Many thanks!

James 

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!