Hi @gauravu_14 , in general, having a lookup containing the host to monitor list, you can use a search like this: | tstats count WHERE index=* BY host
| append [ | inputlookup your_lookup.csv | eval count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0 if you are monitoring some clusters, you should have in the lookup the indication of the clusters, something like this: primary_host secondary_host
host1 host1bis
host2
host3 host3bis
host4 and run a little different search: | tstats count WHERE index=* BY host
| lookup your_lookup.csv primary_host AS host OUTPUT secondary_host
| lookup your_lookup.csv seondary_host AS host OUTPUT primary_host
| append [
| inputlookup your_lookup.csv
| rename primary_host AS host
| eval count=0
| fields host count ]
| append [
| inputlookup your_lookup.csv
| rename secondary_host AS host
| eval count=0
| fields host count ]
| stats
sum(count) AS total
values(primary_host) AS primary_host
values(secondary_host) AS secondary_host
BY host
| where total=0 AND NOT (primary_host=* secondary_host=*) About the indexes related to the not sending hosts, it's more difficoult because you don't have, in this search the information about the indexes, the only way is to store in the lookup also the information about the indexes usually used, in this case you can add this information in the stats commands: | tstats count WHERE index=* BY host
| lookup your_lookup.csv primary_host AS host OUTPUT secondary_host indexes
| lookup your_lookup.csv seondary_host AS host OUTPUT primary_host indexes
| append [
| inputlookup your_lookup.csv
| rename primary_host AS host
| eval count=0
| fields host count ]
| append [
| inputlookup your_lookup.csv
| rename secondary_host AS host
| eval count=0
| fields host count ]
| stats
sum(count) AS total
values(primary_host) AS primary_host
values(secondary_host) AS secondary_host
values(indexes) AS indexes
BY host
| where total=0 AND NOT (primary_host=* secondary_host=*) Ciao. Giuseppe
... View more
