topic Re: Search processing language in Splunk Search

Search processing language

EHariharan — Mon, 04 Feb 2019 20:46:42 GMT

Hi Everyone,

Can any one help me with SPL to extract report of recent log sources reporting with time and the time difference from current time.

Thanks in Advance!

Re: Search processing language

chrisyounger — Mon, 04 Feb 2019 20:49:18 GMT

Hi @EHariharan

This is a very hard problem, however the metawoot app does the best job of providing the sort of reports you want: https://splunkbase.splunk.com/app/2949/

Silly name, excellent app 🙂

All the best.

Re: Search processing language

EHariharan — Mon, 04 Feb 2019 21:10:45 GMT

Thank you Chris.

But do i have any chance to extract report using query?

like adding some more query with following
* | stats values(source) by host

Re: Search processing language

chrisyounger — Mon, 04 Feb 2019 21:36:07 GMT

Sorry I can't give you a simple answer. There are a lot of complexities becuase if you have time parsing problems, then the events won't show up in your search in the first place.