Splunk Search

How do I search and alert on processes that are not running on a list of hosts?

gcusello
SplunkTrust
SplunkTrust

I have to identify processes not running on a list of hosts.
To do this, I have a lookup table with all the processes for every host and I have a script that extract ps from linux servers.
I'm able to find hosts with no running processes using the following search:

| inputlookup Processes.csv |eval host=upper(host)| search host="*"| eval count=0 | append [search index=services host=*| search [| inputlookup Processes.csv | search host="*" | eval query=Process | table host query] |eval host=upper(host)| stats count by host ] | stats sum(count) AS Total by host

But the problem is that I need to verify both host and process names (not only host like the previous search).
I tried to use two fields (host and Process) in the stats count (instead of only host) but the problem is that the process names (values) are different between lookup and events. For example, in the lookup, I have mailman and in ps result I have arm_32000_--_2002_OPCMASTER_MAILMAN_UNIX_8.6_SONONLY.

So I can find the process name in the events, but I don't know how to verify when a process is not running.

Anyone can give me any suggestion?
Anyone encountered a similar problem?
thank you.
Giuseppe

0 Karma
1 Solution

woodcock
Esteemed Legend

Modify your ps command to provide output formatted more to your liking. The man pages on ps document an incredible array of formatting options.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Modify your ps command to provide output formatted more to your liking. The man pages on ps document an incredible array of formatting options.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...