Splunk Search

Find results that appears in a % of the cases and list the outliers

felipesodre
Path Finder

Hi there,

First of all, thank you for any comment.

I am looking for a way to identify if I have any index missing across databases in my environment.

So, I am logging in Splunk all indexes I have across the environment and the results looks like as following:

 

 

[
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_a"
},
{
"indexrelname":" index_2",
"table":" tb_2",
"database":"db_a"
},
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_b"
},
{
"indexrelname":" index_2",
"table":" tb_2",
"database":"db_b"
},
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_c"
},
Missing index_2 tb_2 here...
]

 

 

So, as an example I would like to find the missing index "index_2" on  the table "tb_2" on database "db_c". 

The result would be a table of missing index:

database | table | indexrelname 

db_c         |  tb_2  | index_2

Does anyone able to  help ?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...