topic What can be a light sanity check for content? in Security

What can be a light sanity check for content?

ddrillic — Mon, 20 Feb 2017 19:26:33 GMT

Our users would like to run queries, on a regular basis, which would show them that their data keeps flowing in without issues. One user came up with the following - index=xxxxxx earliest=-1m | stats latest(_time) as latestTime by host sourcetype source | eval latestTime=strftime(latestTime,"%x,%X")

Is it reasonable? I think that tstats is better, right?

Re: What can be a light sanity check for content?

somesoni2 — Mon, 20 Feb 2017 19:34:28 GMT

Tstats much better as it's faster. Since multiple users are going to run this, you need something faster.

| tstats latest(_time) as latestTime WHERE index=xxxxxx earliest=-1m by host sourcetype source | eval latestTime=strftime(latestTime,"%x,%X")

Re: What can be a light sanity check for content?

ddrillic — Mon, 20 Feb 2017 19:36:25 GMT

Perfect!!!