From a high level, I would do something like this: Create a lookup table of assets including the fields isExpected Schedule a lookup search to identify when a new host sends data, and add it to the asset lookup table with the isExpected value to 1 Schedule another search that looks for the poweroff event and sets the isExpected value to 0 Now you can identify when a host is expected and stops sending data. This is what I'd start with for Windows, I'm not sure what I'd do for the other systems or if it's possible, it depends on what's being logged to Splunk from those devices. ... View more