My dear comrades, I'm facing something unreal. We just deployed application on the host that looks like [monitor://C:\Data\log\*]. Unfortunately we cannot see any entries on splunk. But when I copied some files to another location on host and also we changed application to something like [monitor://C:\Program Files\Data\log\*]. It sends data.  The folders permission etc are all same. Our application is hard coded so we cannot change the path just like this test. Any help will be much appreciated

Hi All, I have got two queries to populate the host, region, tech stack & environment details. One query is a lookup table that has the list of total number of host.    | inputlookup Master_List.csv | search Region="Asia" | search "Tech Stack"="Apple" | rename host as Total_Servers | table Total_Servers   which gives below table: Total_Servers Apple1 Apple2 Apple3 Apple4 Apple5 Apple6 The second query gives us the list of hosts that are currently populating in splunk.   ... | rex field=_raw "(?ms)]\|(?P<host>\w+\-\w+)\|" | rex field=_raw "(?ms)]\|(?P<host>\w+)\|" | rex field=_raw "\]\,(?P<host>[^\,]+)\," | rex field=_raw "\]\|(?P<host>[^\|]+)\|" | regex _raw!="^\d+(\.\d+){0,2}\w" | regex _raw!="/apps/tibco/datastore" | lookup Master_List.csv "host" | search "Tech Stack"="Apple" | search Region="Asia" | rename host as "Reporting_Servers" | table "Reporting_Servers"   which gives below table: Reporting_Servers Apple1 Apple4 Apple5 Now I want to create a query to compare these two table and populate the servers that are missing from the total servers. So that output of the above tables after comparison should be like below: Non_Reporting_Servers Apple2 Apple3 Apple6   Please help me to create a query to achieve the expected output table. Your kind inputs are highly appreciated.   Thank You..!!!