topic Re: finding the most recent sourcetype=hardware (similar to metadata command) in Splunk Search

finding the most recent sourcetype=hardware (similar to metadata command)

lemikg — Tue, 12 Mar 2013 12:04:43 GMT

Hello everyone,

in my dashboard I have a table displaying the hardware configuration of a server and several other searches. So this is what I do, I pick a host, a timerange and hit search.
Depending on the timerange the desired table shows no results.

Is there a way to search for the most recent event of that stream / sourcetype=hardware where the hardware information was logged?

Thanks for your help.

regards
mike

Re: finding the most recent sourcetype=hardware (similar to metadata command)

alacercogitatus — Tue, 12 Mar 2013 12:19:45 GMT

You could increase your timerange and use |head 1. This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table.

In transforms.conf put:

[hardware] filename = hardware.csv

Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data):

sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware

Then in your search you can do:

your_search | lookup hardware host | do_things_with_hardware

Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

Re: finding the most recent sourcetype=hardware (similar to metadata command)

lemikg — Tue, 12 Mar 2013 13:42:40 GMT

hi alacercogitatus, thanks for your reply. I was thinking of the lookup too and is probably the easiest way. I wanted to avoid increasing the timerange but Due to the number of searches in that particular view and userfriendliness I hoped to find another way of solving this.

From what I understand the metadata searches over time ie. indepently from the set timerange.

I was hoping to find something similar. Do you have something in that direction on your mind?

Re: finding the most recent sourcetype=hardware (similar to metadata command)

alacercogitatus — Tue, 12 Mar 2013 14:01:26 GMT

Well, you could use the timestamps in the metadata and do a second search.

This will return the events of the sourcetype.

Re: finding the most recent sourcetype=hardware (similar to metadata command)

lemikg — Sat, 23 Mar 2013 18:42:57 GMT

i think this should do it, I will try this. thank you very much.