Dear Community,
I am writing a search for windows services. I am trying to find out the number of hosts that having/not having a certain service.
Here is the search that I have to find out servers that having the services running:
Hi @JamesJ,
you have to create a lookup (called e.g. perimeter.csv) containing all the monitored servers (only one column with "host").
Then you hav e to modify your search having something like this:
index=*_oswin sourcetype="WMI:Service" source="WMI:Service" Name="Appdynamics Machine Agent"
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Not present","Present")
| stats count BY status
Ciao.
Giuseppe
Hi @JamesJ
To find not running services you should have catalog list of services in a lookup or somewhere in splunk.
Can you describe what's first part, second part here that you want to see?
Hi Venk,
Thanks for replying.
The first part is to list all servers that having a particular service (e.g. Spooler) installed.
The second part is to list all servers that don't have this service installed.
Finally, I want to put the number into a pie chart.
Hope that makes sense.
Hi @JamesJ,
you have to create a lookup (called e.g. perimeter.csv) containing all the monitored servers (only one column with "host").
Then you hav e to modify your search having something like this:
index=*_oswin sourcetype="WMI:Service" source="WMI:Service" Name="Appdynamics Machine Agent"
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Not present","Present")
| stats count BY status
Ciao.
Giuseppe