Last Time Heavy Forwarder received logs from it's Source

itsmevic — Tue, 12 Jan 2021 02:03:40 GMT

I've pieced together some SPL that shows me the last time the forwarder has sent its log data, but need to convert the | eval Hour =relative_time(_time,"@h") to normal date-time format, i.e. HH:MM:SS. Any help is greatly appreciated!

index=_internal sourcetype=splunkd group=tcpin_connections component=Metrics | eval sourceHost=coalesce(hostname, sourceHost) | rename connectionType as connectType | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder") | fillnull version value="pre 4.2" | rename version as Ver arch as MachType | fields _time,connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver MachType | eval Indexer= splunk_server | eval Hour=relative_time(_time,"@h") | stats avg(tcp_KBps) as avg_TCP_KBps avg(tcp_eps) as avg_TCP_eps sum(kb) as total_KB by Hour connectType sourceIp sourceHost MachType destPort Indexer Ver

Re: Last Time Heavy Forwarder received logs from it's Source

scelikok — Tue, 12 Jan 2021 05:51:43 GMT

Hi @itsmevic ,

You can convert it using below at the end of your query;

| convert ctime(Hour)

If this reply helps you an upvote is appreciated.

topic Re: Last Time Heavy Forwarder received logs from it's Source in Getting Data In

Last Time Heavy Forwarder received logs from it's Source

Re: Last Time Heavy Forwarder received logs from it's Source