Splunk Search

Splunk Query to find removed hosts

alexspunkshell
Communicator

Hi All,

Please help me with splunk query to find removed (Off-boarded) hosts & index in splunk

Labels (4)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Could you please be more specific about the use case?  Which hosts, those monitored by Splunk or those running Splunk?  Do you also want to detect removed indexes or index removed hosts?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

alexspunkshell
Communicator

@richgalloway Thanks for your reply.

Splunk query for removed hosts those are monitored by Splunk.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!