How do I list machines that do not match my search? "if" my script runs, a message is sent to splunk. The script runs once a week. I can easily see the details of my scripts, if it runs in splunk. So how do I list the machines that this script doesn't even start on? eg no entry sent to splunk. This search does not list those who count is "zero", how do I list the "zero" machines?     "MyAppResults" | stats count by host | stats sum(count) as count by host   If I understood I should be using  "inputlookup hosts.csv" but I'm not sure how to use it properly. I still cannot get it to list "zero" machines. ... View more

I am trying to find all unique messages sent to syslog from specific machines Splunk 6.6.8 Using the following bash command, I get what I want: grep -v "sendmail\|nrpe\|freshclam" /var/log/messages | cut -c27- |sort| uniq -c The following Splunk search comes close, but cuts out some results: host="srvr1" OR host="srvr2" NOT ( sendmail OR nrpe OR freshclam ) | dedup process As an example, I only get one of these lines instead of all three: ### init: Id "x" respawning too fast: disabled for 5 minutes ### init: Id "y" respawning too fast: disabled for 5 minutes ### init: Id "z" respawning too fast: disabled for 5 minutes Splunk will only return one of those lines. If I do a general search for the other two errors, they are there in Splunk so they are captured. I tried a dedup on other fields, but so far "process" seems to be the best fit. Any suggestions? ... View more