topic Re: Creating a metadata report gives wrong date in Reporting

Creating a metadata report gives wrong date

EldadDor — Tue, 01 Apr 2014 09:11:05 GMT

I've found in the forum a nice way to query the metadata tables to check if our servers are writing logs,

the search term I'm using:

| metadata type=hosts index=distrib | eval mytime=strftime (recentTime, "%y-%m-%d %H:%M:%S") | eval currentTime=strftime(now(), "%y-%m-%d %H:%M:%S") | eval minutesAgo=round(((now()-recentTime)/60),0) | table sourcetype,host,lastTime,source,recentTime,mytime,currentTime,minutesAgo | where (abs(minutesAgo) > 1)

which works great, but when I'm using it as a report, the generated report gives
the current time as 70-01-01 02:00:00.
The TimeRange configured is

start time: rt-1m

finish time: rt

(I've tried some other time variations, but always got the same result)

(btw we're using Splunk 6)

Can you provide any help on the subject?

Re: Creating a metadata report gives wrong date

martin_mueller — Tue, 01 Apr 2014 10:11:08 GMT

Use time() instead of now(). The latter gives you the time the search was launched, and can be trouble in certain constellations. Using time() will also self-update the timestamp over the potentially long-running realtime search.

Re: Creating a metadata report gives wrong date

EldadDor — Wed, 02 Apr 2014 09:24:30 GMT

Did the trick 🙂