Refine your search:

Hi there,

I want to check, which System aren't having forwarders installed. I am using the 'all_forwarder' search macro which comes with the Deployment Monitor App. With this macro search I get all Forwarders.

So on the one hand there is a lookup file with all servers in my landscape. On the other hand I have 'all_forwarder' macro which displays all forwarders.

Now I want to check the lookup against the 'all_forwader' macro. The result should list all servers which are not matching with the Hostlist from the 'all forwarder'

lookup : all_servers fields with the server host : sourceHost

macro search: all_forwarders fields with the forwarder hosts : sourceHost

Thanks in advance

Regards

asked 18 Apr '12, 01:48

nebel's gravatar image

nebel
25915
accept rate: 66%


One Answer:

This should do it, if I understood your question correctly:

| inputlookup all_servers | search NOT [search `all_forwarders` | fields sourceHost]
link

answered 18 Apr '12, 02:33

Ayn's gravatar image

Ayn
25.3k3717
accept rate: 41%

thank you very much!

(18 Apr '12, 02:46) nebel
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×290
×40
×24
×6

Asked: 18 Apr '12, 01:48

Seen: 625 times

Last updated: 18 Apr '12, 02:46

Copyright © 2005-2012 Splunk Inc. All rights reserved.