Hi,
hopefully someone can give me an advise.
On the one hand I am having a lookup file which contains only simple server names, for instance
Server A
Server B
Server C
From some of them I am having logs, from some of them not. The goal is to create a table which contains all my servers in the lookup file. And then I want to have a another field which contains informations about how often I've got logs from them servers.
Server A 116 Events
Server B 690 Events
Server C 0 Events
How can I realise this? I only want to see servers from my lookup file, and I also want to see if the server sends zero events.
Thank you very much
Regards
Try this
| inputlookup myserverlookup
| join type=outer host
[ search index=_internal sourcetype=splunkd source=*metrics* "group=per_host_thruput" earliest=-24h
| stats sum(ev) as events by series
| fields - host
| rename series as host ]
| join type=outer host [ | metadata type=hosts index=* | fields host lastTime ]
| fieldformat lastTime = strftime(lastTime,"%x %X")
| fieldformat events = tostring(events,"commas")
| sort host
| fields host events lastTime
This assumes that your lookup is called myserverlookup
and that the field name in the associated csv is host
.
This search tries to do things efficiently - instead of looking at all the indexes and counting up all the events - which would take a long time - it uses Splunk's internal metrics to count the events and the last time an event arrived from each host.