Splunk Search

Find results that appears in a % of the cases and list the outliers

felipesodre
Path Finder

Hi there,

First of all, thank you for any comment.

I am looking for a way to identify if I have any index missing across databases in my environment.

So, I am logging in Splunk all indexes I have across the environment and the results looks like as following:

 

 

[
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_a"
},
{
"indexrelname":" index_2",
"table":" tb_2",
"database":"db_a"
},
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_b"
},
{
"indexrelname":" index_2",
"table":" tb_2",
"database":"db_b"
},
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_c"
},
Missing index_2 tb_2 here...
]

 

 

So, as an example I would like to find the missing index "index_2" on  the table "tb_2" on database "db_c". 

The result would be a table of missing index:

database | table | indexrelname 

db_c         |  tb_2  | index_2

Does anyone able to  help ?

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!