Alerting

How do you find hosts that are not sending specific EventIDs?

simpsobr345
New Member

I'm trying to search my log data and figure out if a list of host names are not sending specific event IDs.

I have a lookup table called audit_items.csv with the following: 4624 has data while 7777 purposely shows nothing.

EventID
4624
7777

My search looks like this.

| inputlookup audit_items.csv
| join type=outer EventID 
 [ search host="127.0.0.1:8088" 
 | stats count by EventID Hostname]
  | table Hostname, EventID count 
 | fillnull value=0 

What I would like to do is add another lookup table with a list of Hostnames so that instead of my results showing nothing for an EventID 7777 that it will also tell me each Hostname not sending each type of EventID.

Thanks

Tags (1)
0 Karma

renjith_nair
Legend

@simpsobr345 ,

Give this a try,

host="127.0.0.1:8088" | stats count by EventID Hostname|append [|inputlookup audit_items.csv] 
|eventstats values(Hostname) as Hostname
|stats values(Hostname) as tempHost,values(Hostname) as Hostname by EventID
|mvexpand Hostname|eval Found=mvfind(tempHost,Hostname)
|eval Found=if(isnull(Found),"No","Yes")|fields - Hostname
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...