Please refer below to get list of host which are not sending logs without using a lookup. https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-determine-when-a-host-stops-sending-logs-to-splunk-expeditiously.html ... View more