Like @richgalloway said, Splunk is not great at searching for for missing things. Meanwhile, if you already have the inventory, there is something you can do. Assuming lookup myinventory is in the ...
See more...
Like @richgalloway said, Splunk is not great at searching for for missing things. Meanwhile, if you already have the inventory, there is something you can do. Assuming lookup myinventory is in the form of hostname IPaddress abc 0.0.0.0 abc 2.2.2.2 xyz 4.5.6.7 zab 7.8.9.10 zab 6.7.8.9 and the requirement is to capture the following entries from the lookup where hostname in this lookup has no matching entry with hostname in index search and IPaddress in this lookup has no matching entry with IPaddress or hostname in index search. To make our task simpler, further assume that if an index search event matches anything in lookup, that hostname and/or IPaddress is/are no longer a candidate. This is what you can try: index=asset_inventory
| stats values(hostname) as hostname values(IPaddress) as IPaddress
| appendcols
[inputlookup myinventory
| stats values(hostname) as lookupname values(IPaddress) as lookupaddress]
| eval missingname = mvmap(lookupname, if(lookupname != hostname, lookupname, null()))
| eval missingaddress = mvmap(lookupaddress, if(lookupaddress != IPaddress AND lookupaddress != hostname, missingaddress, null()))
| lookup myinventory IPaddress as missingaddress output hostname as addressmissingname
| eval missingname = mvappend(missingname, mvmap(addressmissingname, if(addressmissingname != hostname, addressmissingname, null())))
| table missingname Note: the search takes avdantage of Splunk's equality evaluation with multivalue. this search becomes complicated because your index search may return IP address in hostname and apparently you care about those entries. If we ignore those entries and only compare hostname hostnames with inventory, the search can be as simple as index=asset_inventory
| stats values(hostname) as hostname
| appendcols
[inputlookup myinventory
| stats values(hostname) as lookupname]
| eval missingname = mvmap(lookupname, if(lookupname != hostname, lookupname, null()))
| fields - hostname