Hi all,
I have list of 3k+ servers for which i want to check data flow from specific index. How can i do this with optimize search
Hi @nehamvinchankar,
you could insert the server list in a lookup (called e.g. "perimeter.csv"9 containing at least one column (host).
Remember to create also the lookup definition.
then you could run a search like this:
| tstats count WHERE index=your_index BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0
Ciao.
Giuseppe
Not working
I want list of servers which are having index data from the list provided
Hi @nehamvinchankar,
sorry, this is the check that all the servers are sending data.
If you want the server list that sent data is easier, try this:
| tstats count WHERE index=your_index BY host
| table host
Ciao.
Giuseppe