Splunk Search

Create dashboard for hosts that have no results from a specific sourcetype

croseberry
Engager

Hey guys I'm trying to create a dashboard that shows any host with a group of specified hosts that are not returning data from a specific source type

So what I have been trying so far to no success is 

Index=xyz Host=abc  Sourcetype=def 
|  timechart span=30min count by host
Where count < 1
usenull=f useother=f

This won't show anything because it going to have no events to report but I'm not sure how I can create a variable base upon have no results back within a specific time then do a timechart base upon the new variable by host

Unless I'm going about this completely wrong lol please help 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...