Splunk Search

.

Kksplunker
Loves-to-Learn
 
Labels (1)
0 Karma

gcusello
Legend

Hi @Kksplunker,

try something like this:

index="windows" State="*" service="CB" 
| eval host=upper(host)
| stats count BY host
| append [ | inputlookup itsi_entities | rename identifier.values as host | eval host=upper(host), count=0 | fields host count ] 
| stats sum(count) AS total BY host
| where total=0
| table total 

Ciao.

Giuseppe

0 Karma

Kksplunker
Loves-to-Learn

.

0 Karma

gcusello
Legend

Hi @Kksplunker,

ok, let me understand:

  • you have some servers with service="CB" and some others without this service,
  • you want the list of all servers without this service?

it's easier, did you tried this?

index="windows" State="*" NOT service="CB"
| ...

 Ciao.

Giuseppe

0 Karma

Kksplunker
Loves-to-Learn

.

0 Karma

gcusello
Legend

Hi @Kksplunker,

sorry but I don't understand your need:

  • if you want the servers, from your lookup, without the service CB, you can use my first answer,
  • if you want the servers, in all your infrastructure, without the service CB, you can use my second answer;

what's your need?

In my opinion you need the first, in which there are the list of all servers with service=CB active that are sending logs and there's the match with the list of all your server from the lookup:

  • total=0 means that you haven't servers with service=CB that are sending logs,
  • total>0 means that you have servers with service=CB that are sending logs,

if in your lookup you have more than Windows servers, you have to filter the lookup in the append.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...