All, I am looking for a solution to identify the hosts that have stopped reporting to Splunk using lookup table. However, the condition is there are Primary and Secondary hosts for some data types. I do not want to get alerted if either of the hosts (Primary or Secondary) is reporting. At the same time I would like to map these hosts to their respective index. So if a host(both primary and secondary in some cases) from a particular index stops reporting an alert should trigger (will probably have another column for index mapping the hosts). Any solution would be highly appreciated!!
... View more