topic Re: Create Search for a Host who dont send Data for x minutes in the last 10 Days in Splunk Search

Create Search for a Host who dont send Data for x minutes in the last 10 Days

mklhs — Mon, 08 Jul 2019 11:05:11 GMT

Hello,

i wanted to write a search which will return all hosts which have not sent any events for 10 minutes in the last 10 days.
Normally the servers send every minute.

Re: Create Search for a Host who dont send Data for x minutes in the last 10 Days

renjith_nair — Mon, 08 Jul 2019 13:22:03 GMT

@mklhs,

Try

    | metadata type=hosts where index=* OR index=_*|eval delay=round((now()-lastTime)/60)|where delay >10| fields host,delay

Re: Create Search for a Host who dont send Data for x minutes in the last 10 Days

mklhs — Mon, 08 Jul 2019 14:17:46 GMT

Thank you!
but if I now have a time interval we say from last week Wednesday to yesterday how would I change the query? somehow that doesn't quite want to be me

Re: Create Search for a Host who dont send Data for x minutes in the last 10 Days

renjith_nair — Tue, 09 Jul 2019 02:24:00 GMT

@mklhs,

Try this with time range

tstats count,max(_time) as _time where index=* by host | eval delay=(now()-_time)/60

Re: Create Search for a Host who dont send Data for x minutes in the last 10 Days

mklhs — Wed, 30 Sep 2020 01:12:09 GMT

Hello Guys,

i got it with that query:

index= sourcetype= | eval age = (now() - _time ) | stats first(age) as age, first(_time) as LastTime by xxx | convert ctime(lastTime) as "Last Active On" | eval Status=case(age < 600, "running",age > 600,"Down"

with the last eval i have determined from when a server counts as not available for me

I hope it Helps someone

Thanks @renjith.nair