Splunk Search

Query on stats value = 0 or null

christay
New Member

Hi Guys,

I have a question here.
Example i have a query statement that check for event logs captured by all my servers(Say total i have 30) during the last 10 mins.

if i run the following query :
index=ind_audit_log (sourcetype=linux_secure OR sourcetype=linux_audit) | stats count by host

It only returns me 25 servers which has event logs being pipe to splunk. The rest of the servers(5 in total) that does not have event logs pipe to splunk was not being reflected in the above query.

How can i craft and run a query to sieve out those servers that does not have any event logs being pipe to my splunk so that i can create an alert to notify me to check on the servers.

Thanks!

0 Karma
1 Solution

HiroshiSatoh
Champion

I think that using LOOKUP FILE is a staple, but there are also such search sentences.

|tstats count  
      WHERE index=ind_audit_log AND (sourcetype=linux_secure OR sourcetype=linux_audit) 
      by host 
| append [| metadata type=hosts index=ind_audit_log |eval count=0|table host,count]
| stats sum(count) as count by host

Unnecessary hosts should be excluded by WHERE clause etc.

View solution in original post

0 Karma

HiroshiSatoh
Champion

I think that using LOOKUP FILE is a staple, but there are also such search sentences.

|tstats count  
      WHERE index=ind_audit_log AND (sourcetype=linux_secure OR sourcetype=linux_audit) 
      by host 
| append [| metadata type=hosts index=ind_audit_log |eval count=0|table host,count]
| stats sum(count) as count by host

Unnecessary hosts should be excluded by WHERE clause etc.

0 Karma

christay
New Member

Hi Hiroshi,

Thanks for the query, it works as intended.

Cheers.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...