how to search a service that not running on certain hosts

[JamesJ]

Dear Community, 

I am writing a search for windows services. I am trying to find out the number of hosts that having/not having a certain service.  

Here is the search that I have  to find out servers that having the services running: 

index=*_oswin sourcetype="WMI:Service" source="WMI:Service" Name="Appdynamics Machine Agent" | dedup host  | stats sum()

How can I do the second part please? Also, I want to integrate those two numbers into one pie chart. Any suggestion is highly appreicated! 

[venkatasri]

Hi @JamesJ 

To find not running services you should have catalog list of services in a lookup or somewhere in splunk.

Can you describe what's first part, second part here that you want to see?

[JamesJ]

Hi Venk,

Thanks for replying. 

The first part is to list all servers that having a particular service (e.g. Spooler) installed.

The second part is to list all servers that don't have this service installed. 

Finally, I want to put the number into a pie chart. 

Hope that makes sense. 

[gcusello · Accepted solution]

Hi @JamesJ,

you have to create a lookup (called e.g. perimeter.csv) containing all the monitored servers (only one column with "host").

Then you hav e to modify your search having something like this:

index=*_oswin sourcetype="WMI:Service" source="WMI:Service" Name="Appdynamics Machine Agent" 
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Not present","Present")
| stats count BY status

Ciao.

Giuseppe

[JamesJ]

Hi @gcusello ,

Appreciate the hints. I will go ahead with a try with input lookup.

Many thanks!

James