https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75878#M15485 <P>This is my stab at it:</P> <PRE><CODE>| metadata type=hosts sourcetype="example" | convert ctime(recentTime) as Recent_Time | where lastTime LESSTHANSYMBOL (now() - 600) </CODE></PRE> <P>I am using this query - (now() - 600) translates to look between now and 10 minutes(600 seconds) before of now.</P> <P>Does look ok ? </P> Thu, 14 Jun 2012 18:50:53 GMT asarolkar 2012-06-14T18:50:53Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75878#M15485 <P>This is my stab at it:</P> <PRE><CODE>| metadata type=hosts sourcetype="example" | convert ctime(recentTime) as Recent_Time | where lastTime LESSTHANSYMBOL (now() - 600) </CODE></PRE> <P>I am using this query - (now() - 600) translates to look between now and 10 minutes(600 seconds) before of now.</P> <P>Does look ok ? </P> Thu, 14 Jun 2012 18:50:53 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75878#M15485 asarolkar 2012-06-14T18:50:53Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75879#M15486 <P>This is probably closer to what you'll want:</P> <PRE><CODE>| metadata type=sourcetypes | eval search_time=(now()-600) | eval status=if(lastTime&lt;search_time, "NOT_OK", "OK") | table sourcetype, status </CODE></PRE> Thu, 14 Jun 2012 19:05:37 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75879#M15486 Lamar 2012-06-14T19:05:37Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75880#M15487 <P>You could easily translate this to a by 'host' search as well. Just change the word 'sourcetype' to 'host'.</P> Thu, 14 Jun 2012 19:06:50 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75880#M15487 Lamar 2012-06-14T19:06:50Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75881#M15488 <P>Fantastic ! This gives me across all sourcetypes</P> Thu, 14 Jun 2012 20:01:11 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-not-forwarding-for-10-minutes/m-p/75881#M15488 asarolkar 2012-06-14T20:01:11Z