All, I am looking for a solution to identify the hosts that have stopped reporting to Splunk using lookup table.  However, the condition is there are Primary and Secondary hosts for some data types. I do not want to get alerted if either of the hosts (Primary or Secondary) is reporting. At the same time I would like to map these hosts to their respective index. So if a host(both primary and secondary in some cases) from a particular index stops reporting an alert should trigger (will probably have another column for index mapping the hosts). Any solution would be highly appreciated!!  ... View more

I have created a tag for a key-value pair (dvc=IP_Address) and shared it will all the apps. Which doing a search for the logs related to the above device, I can see the tag appearing for that key value pair (dvc=IP_Address(Tag_Name)). However, this tag is not working for the notable events. It does not appear for the notables under Incident Review of Splunk ES. These tags were working prior to the new ES update. Looking for the solution regarding the same ... View more