topic Re: Query to return all forwarder versions and the last time that they sent data? in Getting Data In

Query to return all forwarder versions and the last time that they sent data?

the_wolverine — Thu, 05 May 2016 16:07:44 GMT

Please provide a query that will show me the version of my forwarders and when they last shipped me data.

Re: Query to return all forwarder versions and the last time that they sent data?

the_wolverine — Thu, 05 May 2016 16:10:20 GMT

index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log 
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| join hostname [ | metadata type=hosts index=* 
| eval last_seen_hours=(now()-lastTime)/60/60 
| table host, last_seen_hours 
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

This removes the domain component of hostname to ensure a match between metrics and metadata host value.

Re: Query to return all forwarder versions and the last time that they sent data?

twinspop — Thu, 05 May 2016 16:59:55 GMT

Curious about your use of dedup and table vs stats. With this snippet replacing that section of your search:

 | stats latest(version) as version latest(arch) as arch latest(os) as os latest(build) as build by hostname
 | rex field=hostname "(?<hostname>[^\.]+)"

... the search takes about 15% less time for me. Not a huge savings, for sure, but still.

Any advantage to using depup + table?

Re: Query to return all forwarder versions and the last time that they sent data?

the_wolverine — Thu, 05 May 2016 18:07:23 GMT

Yep thanks for the reminder. I normally use stats and have updated the query. I came up with the query this morning and post it on answers as a future reference for myself and others.