Getting Data In

How to get a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?

francly
Explorer

This is the sample of the event field, start from EID are the data ingest from app, how can I get the output in last 3 days the hostname do not have any event come in the Splunk

2019-03-12 08:25:57 EID="267252209", EDT="2019-03-12 08:25:57.0", RULE_NAME="RULE1", HOSTADDR="1.1.1.1", HOSTAME="SERVER1"
Tags (2)
0 Karma

francly
Explorer

Anyone can help?

0 Karma

francly
Explorer

Anyone can help?

0 Karma

nickhills
Ultra Champion

I just added a comment below, please try that and let me know how you get on.

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Hi,

You can use the metadata from your deployment to find hosts which have previously sent events, but have not done so recently

| metadata type=hosts index=_internal | eval oldest=now()-lastTime | where oldest>86400*3

You may want to run this over a long time period, such as 30 days - this will show you hosts which have sent you something in the last month, but NOT in the last 3 days.

If my comment helps, please give it a thumbs up!
0 Karma

francly
Explorer

I search all time but no result display

0 Karma

ddrillic
Ultra Champion

Do you have access to _internal?

0 Karma

francly
Explorer

I'm using the relevant index name and sourcetype for my env

| metadata type=secevent index=sec l | eval oldest=now()-lastTime | where oldest>86400*3
0 Karma

nickhills
Ultra Champion

you cant specify type in a metadata search, only metadata that was created at indextime.

Try:
| metadata type=hosts index=sec | eval oldest=now()-lastTime | where oldest>86400*3

If my comment helps, please give it a thumbs up!
0 Karma

DMohn
Motivator

If I understand your query correctly you want to have a list of all hosts, which have NOT sent an event to Splunk in the last 3 days?
To achieve this you first need to have a list of all hosts you are expecting to send, so you have the values to compare against. Then you can write a query to show you all hosts that have not reported.

I assume, your events have extracted fieldnames here (if not, please advise), and you have created a lookup CSV containing all hostnames you expect. Your query then would look like this:

 | inputlookup yourhostnames.csv | search NOT [search <your_base_query_returning_the_events> earliest=-3d | dedup HOSTNAME | table HOSTNAME]
0 Karma

francly
Explorer

all the event send to this index and source, I don't want compare just look up existing event "HOSTNAME" and output the "HOSTNAME" no event more than 3 days

index=sec sourcetype="secevent"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...