topic how - metadata host by index and sourcetype recentTime in Getting Data In

how - metadata host by index and sourcetype recentTime

robf — Wed, 30 Jul 2014 09:18:06 GMT

This search produces the most recent timestamp for every host for aa specific index

| metadata type=hosts index=windows |
convert ctime(*Time) | table host
index recentTime

how can i break it down a level further by last tinme a host reported in for a given sourcetype and index?

    host   index    sourcetype   recenttime
    host1  windows   system      30/06/2014 04:55
    host1  windows   security    30/06/2014 05:15

Re: how - metadata host by index and sourcetype recentTime

linu1988 — Wed, 30 Jul 2014 10:08:13 GMT

Hello Rob,
If you are on Splunk 6 @martin_mueller 's answer will help you get the info.

http://answers.splunk.com/answers/145995/alert-if-source-stops-indexing

you can maintain a lookup table and make the comparison with metadata.

Thanks,
L

Re: how - metadata host by index and sourcetype recentTime

strive — Wed, 30 Jul 2014 10:18:42 GMT

metadata type=hosts doesn't contain sourcetye information.

Check this

http://answers.splunk.com/answers/10005/how-to-get-host-sourcetype-and-source-from-a-single-metadata-search

You may need different combinations. This link http://answers.splunk.com/tags/metadata/ has questions tagged with metadata. Some of these may help you.

Re: how - metadata host by index and sourcetype recentTime

strive — Wed, 30 Jul 2014 10:27:53 GMT

|metasearch index=* sourcetype=* host=* | table index sourcetype host

This wont fetch recentTime

Re: how - metadata host by index and sourcetype recentTime

somesoni2 — Wed, 30 Jul 2014 15:11:53 GMT

There is no in-build metadata which gives this information grouped by index, sourcetype and host all.

You can try this to get the the timestamp of last written entry for index, sourcetype host combination. This is the fastest available search I believe for this requirement (other than @martin's which is specific to Splunk6).

|metasearch index=clm_transactions sourcetype=* host=* | stats max(_time) as recentTime by index sourcetype host

select appropriate time range for the search so that you can cover most of the host. It won't report for the hosts which have written any entries in given time range.