Splunk Search

.

Kksplunker
Loves-to-Learn
 
Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kksplunker,

try something like this:

index="windows" State="*" service="CB" 
| eval host=upper(host)
| stats count BY host
| append [ | inputlookup itsi_entities | rename identifier.values as host | eval host=upper(host), count=0 | fields host count ] 
| stats sum(count) AS total BY host
| where total=0
| table total 

Ciao.

Giuseppe

0 Karma

Kksplunker
Loves-to-Learn

.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kksplunker,

ok, let me understand:

  • you have some servers with service="CB" and some others without this service,
  • you want the list of all servers without this service?

it's easier, did you tried this?

index="windows" State="*" NOT service="CB"
| ...

 Ciao.

Giuseppe

0 Karma

Kksplunker
Loves-to-Learn

.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kksplunker,

sorry but I don't understand your need:

  • if you want the servers, from your lookup, without the service CB, you can use my first answer,
  • if you want the servers, in all your infrastructure, without the service CB, you can use my second answer;

what's your need?

In my opinion you need the first, in which there are the list of all servers with service=CB active that are sending logs and there's the match with the list of all your server from the lookup:

  • total=0 means that you haven't servers with service=CB that are sending logs,
  • total>0 means that you have servers with service=CB that are sending logs,

if in your lookup you have more than Windows servers, you have to filter the lookup in the append.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...