Getting Data In

How do you check missing values from an input list and set an alert when values are missing?

RishiMandal
Explorer

I have a scenario wherein each heavy forwarder has syslog listeners running. I need an alert or something in the dashboard to show that a particular heavy forwarder has the following listener down.

I did the following and was able to list the Splunk heavy forwarder, listener and its associated PID:

 index=operatingsys host=hf1 OR host=hf2 or host=hf3 source="/var/run/syslog/*" | rex .......... | table host listenername PID
 o/p was as follows 
host listenername PID
hf1   ciscolistener   123
hf1   winlistener      567
hf2   ciscolistener   345
hf2   winlistener      789
hf3   ciscolistener   654
hf3   winlistener      523
hf3  whitecoat          231

Now , I can share an input CSV list as below which is static

host listenername
hf1   ciscolistener   
hf1   winlistener 
hf1   whitecoat    
hf2   ciscolistener   
hf2   winlistener 
hf2   whitecoat    
hf3   ciscolistener
hf3   whitecoat   
hf3   winlistener

As you see in my search output, hf2 and hf3 have whitecoat missing (meaning whitecoat listener status is down, and technically, it will not have PID assigned as it is down). I need to show that the listeners on the heavies are down in a dashboard/report, and for an alert to be generated whenever any listener is down on one of our heavy forwarders.

Open to discussion on using any different approach, if possible to wrap this up

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

try this:

index=operatingsys host=hf1 OR host=hf2 or host=hf3 source="/var/run/syslog/*" | rex .......... | table host listenername PID
| append [|inputlookup CSV_LIST | fields host listenername ]
| stats latest(*) as * by host listenername

By the way, if your CSV has different field names in it, you can use an eval or rename in the subsearch.

All the best

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...