topic Re: Identifying "idle" sources in Getting Data In

Identifying "idle" sources

IgorB — Thu, 14 Oct 2010 18:54:10 GMT

How can I get a list of sources that haven't received any events for a given period of time (e.g. for last 24 hours). Purpose: alert Splunk admin if there are "idle" sources

Re: Identifying "idle" sources

ftk — Thu, 14 Oct 2010 20:32:28 GMT

You can use the following search to identify the last reported time of hosts:

| metadata type=hosts index=blah | sort recentTime desc | convert ctime(recentTime) as Recent_Time

And you can modify it to work on sources by changing hosts to sources:

| metadata type=sources index=blah | sort recentTime desc | convert ctime(recentTime) as Recent_Time

Re: Identifying "idle" sources

southeringtonp — Thu, 14 Oct 2010 20:37:34 GMT

To find sources that have checked in within the last week, but not within the last 24 hours:

| metadata sources
| eval age=now()-recentTime 
| where age>86400 and age<604800
| convert ctime(recentTime) as LastEvent

Tune the cutoff values (in seconds) in line 3 as needed.

Replace sources with hosts or sourcetypes if you want to report on those.

To evaluate for a specific source/sourcetype from a specific host, you would have to query the timestamps of raw events instead of using metadata (which can be much slower).