topic Re: Is it possible to get field values from metadata results? in Getting Data In

Is it possible to get field values from metadata results?

arrowecssupport — Wed, 10 Feb 2016 12:38:52 GMT

I'm running a command to get a list of source types that haven't had data in 7 days, so in short, I'm looking for stuff that is no longer sending in data.

| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | convert ctime(lastTime)  | convert ctime(firstTime)  | convert timeformat="%Y %D" mktime(age) | fields source,firstTime, lastTime,age

Which returns records using meta data and the source name. Is it possible to search that further and get field values?

Re: Is it possible to get field values from metadata results?

somesoni2 — Wed, 10 Feb 2016 15:17:50 GMT

What field values you're interested in?? If you want to look for actual events from that source, you can use result above as subsearch OR in a map command.

Subsearch

index=* [| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | table source ]

Map

| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | table source | map maxsearches=100 search="index=* source=$source$"

Re: Is it possible to get field values from metadata results?

javiergn — Wed, 10 Feb 2016 15:27:06 GMT

Hi,

I'm confused about your question. You are saying you want a list of sourcetypes but you are then running a query that reports sources.
I've also noticed your age filter is wrong because age will be in seconds. In summary I would try the following query instead:

| metadata index=* type=sourcetypes  
| eval ageInDays = round((now()-lastTime)/86400)
| where ageInDays > 7 
| convert ctime(lastTime)  
| convert ctime(firstTime)  
| convert timeformat="%Y %D" mktime(ageInDays) 
| table sourcetype, firstTime, lastTime, ageInDays

If you also want to return some field values you can try something like:

| metadata index=* type=sourcetypes  
| eval ageInDays = round((now()-lastTime)/86400)
| where ageInDays > 7 
| table sourcetype, ageInDays
| map maxsearches=100 search="metasearch index=* sourcetype=$sourcetype$ | head 1"

Let me know if that helps