Thanks much Tohrment. I will surely share the add-on with you for further testing. I will publish the same in splunkbase and share you the link. ... View more

Hi, I have recently worked on a wrapper add-on to work on top of the Splunk NIX Add-On to tap in the output and convert them in to a metric event and transport it to indexers (either via Splunk TCP in csv file format, if the forwarder is of version more than 7 OR send via HTTP Event collector, if the forwarder is version less than 7). I am still trying to do some performance test around that before I can package the same as an add-on and publish it. ... View more

The query that i have provided should do the same. It will run search a Index=os ONLY if there any hosts tagged as UnderMaintenance=Yes. ... View more

this will list out NOT just the hosts sending data BUT also our own host details such as Search head, indexers, Heavy weight forwarders ... View more

index=_internal sourcetype=splunkd host= group=per_host_thruput | fields series | stats values(series) as hosts ... View more

The Inputlookup command supports where condition which means the better way to filter down the search will be | inputlookup StandardMaintenance WHERE UnderMaintenance="Yes" What columns do you expect out of the lookup and added in the filter in base search? Ex - If it is to find the list of Hosts that are not under maintenance and consider them for alerting, sample query can be - index=os sourcetype=vmstat NOT [ | inputlookup StandardMaintenance WHERE UnderMaintenance="Yes" | fields host | table host ] | fields memUsedPct, host | stats avg(memUsedPct) as avgMemUsed by host | where avgMemUsed > 75 | table host ... View more