Splunk Search

Create a report/alert to display hosts that are not reporting /var/log/secure

daniel333
Builder

All,

I have a list of PCI hosts. Now what I want to do is take that list of hosts and create a report/alert to display hosts which are not reporting /var/log/secure. Any idea how I might do this from a search?

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @daniel333, if @somesoni2's solution worked then please don't forget to accept his answer to award karma points and close the question. 🙂

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Assuming you can create a lookup table file with your list of hosts (say myhosts.csv with header as host), try like this

| tstats count WHERE index=IndexWhichHasSecurelogData source="/var/log/secure" [| inputlookup myhosts.csv | table host ] by host
| append [| inputlookup myhosts.csv | table host | eval count=0 ] | stats max(count) as count by host | where count=0
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...