topic Re: Query and Reporting in Splunk Enterprise

Query and Reporting

revanthammineni — Tue, 28 Jul 2020 03:56:29 GMT

Hi Everyone! I'm working on a report to find out the hosts that are not reporting logs. Since it's a huge data set, I'm using command metadata. This command is not allowing me to set up an alert based on time range values. Can anyone suggest me how to pass dynamic time values to the command metadata.

Below is my query.

Thanks in advance.

Re: Query and Reporting

richgalloway — Tue, 28 Jul 2020 13:30:46 GMT

Try using tstats.

Re: Query and Reporting

isoutamo — Tue, 28 Jul 2020 15:05:18 GMT

From splunk slack: !missinghosts

There are a lot of options for finding hosts or sources that stop submitting events:
Meta Woot! https://splunkbase.splunk.com/app/2949/
TrackMe https://splunkbase.splunk.com/app/4621/
Broken Hosts App for Splunk https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts) https://splunkbase.splunk.com/app/3796/
Monitoring Console https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarder_warnings

Some helpful posts:
https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe
https://www.duanewaddle.com/proving-a-negative/

Re: Query and Reporting

revanthammineni — Fri, 31 Jul 2020 19:48:24 GMT

Thanks for the response. I could see the lastTime provided by metadata is different to the last(_time) in tstats.

Giving me different results. Any idea, How we can get the metadata lastTime field using tstats?

Thanks.

Re: Query and Reporting

isoutamo — Fri, 31 Jul 2020 20:04:51 GMT

if I recall right, you must use use “All time” with metadata to get real results.
r. Ismo

Re: Query and Reporting

revanthammineni — Mon, 03 Aug 2020 17:33:40 GMT

Yes. But I'm trying to set up an alerts. Command metadata not allowing me to dynamically pass time values. Also, tstats is not giving me the correct lastTime.