https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374992#M169646 <P>anyone have an idea on how to write up a search that will provide details on which logsource stopped reporting for the last 24 hours?</P> Thu, 03 May 2018 15:25:48 GMT Ghanayem1974 2018-05-03T15:25:48Z https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374992#M169646 <P>anyone have an idea on how to write up a search that will provide details on which logsource stopped reporting for the last 24 hours?</P> Thu, 03 May 2018 15:25:48 GMT https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374992#M169646 Ghanayem1974 2018-05-03T15:25:48Z https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374993#M169647 <PRE>|metadata type=sources | eval age = now() - lastTime | search age &gt; 86400</PRE> Thu, 03 May 2018 15:44:11 GMT https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374993#M169647 pradeepkumarg 2018-05-03T15:44:11Z https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374994#M169648 <P>thank you but do you know if there is a way to separate out the devices that are not reporting? meaning, if its a windows server i want to the actual server that is not reporting. hope this makes sense.</P> Thu, 03 May 2018 15:51:50 GMT https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374994#M169648 Ghanayem1974 2018-05-03T15:51:50Z https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374995#M169649 <P>For hosts, like this (with very large timepicker value):</P> <PRE><CODE>|metadata type=hosts | eval age = now() - lastTime | search age &gt; 86400 </CODE></PRE> Thu, 03 May 2018 16:07:15 GMT https://community.splunk.com/t5/Splunk-Search/Log-sources-not-reporting-in-24-hours/m-p/374995#M169649 woodcock 2018-05-03T16:07:15Z