identify forwarders from a CSV with 0 results from a specific search

[feichinger]

I do have a solution for this, but I just wonder if there is a more straight forward approach to get a better understanding of multi search scenarios.

I want to monitor which Windows forwarders have broken performance counters or are just not sending in performance counters for whatever reason.

There's a CSV lookup file with the server names I want to monitor, and my idea was to have the search give me a table of all the servers in that lookup file which come back with 0 results for a given search.

My working solution is this:

| inputlookup domaincontrollers.csv
| table Name
| eval count=0
| append
[search index=perfmon counter="% Processor Time"
  | rename host as Name
  | stats count by Name]
| stats sum(count) by Name
| rename "sum(count)" as activity
| where activity=0

I had played with appendcols, but found that it would only merge the servers with results in the subsearch, and not list the others in the results.

Is there any search method I should read up on, for a scenario like this?

thanks

[gcusello]

Hi @feichinger ,

your solution has the limit of 50,000 results in the subsearch, so I hint to reverse your searches:

index=perfmon counter="% Processor Time"
| stats count BY host
| append [ 
     | inputlookup domaincontrollers.csv
     | rename Name AS host
     | eval count=0
     | fields host count ]
| stats sum(count) AS total BY host
| where total=0

Ciao.

Giuseppe