topic Re: To check logs and the status in Splunk Search

To check logs and the status

prettysunshinez — Wed, 30 Sep 2020 05:36:31 GMT

Hi,
I would like to run a search,which gives me the list of host with status' - normal,warning and critical
Where Critical being logs not present in a host for 30 mins,warning - not present in 15 mins and but lesser than 30 mins and otherwise its normal.
Am facing 2 problems here,if a server has no logs for 2 days,and when i run a search today,my search is not showing up that host itself.
Another problem is that when change my time modifier to issue time,it is not showing the exact result.

Below is the query used.

index = abc* host=efg*
|stats latest(_time) as latest by host
|eval Status = case (latest <= relative_time(now(),"-15m") AND latest > relative_time(now(),"-30m"),"Warning",
latest <= relative_time(now(),"-30m"),"Critical",
true(),"Normal")
|eval Recent_Updated_Time = strftime(latest,"%c")

Kindly suggest

Re: To check logs and the status

anthonymelita — Tue, 02 Jun 2020 23:48:44 GMT

Metadata search should be faster, and capture hosts without recent events. Otherwise you may need to use a lookup to define your list of hosts.

| metadata type=hosts index=abc*
| search host=efg*
| eval warn=relative_time(now(), "-15m")
| eval crit=relative_time(now(), "-30m")
| eval status=case(recentTime >= warn, "Normal", recentTime < warn AND recentTime >= crit, "Warning", recentTime < crit, "Critical", 1==1, "Undefined")
| table host recentTime status totalCount
| eval recentTime=strftime(recentTime, "%c") ]

Re: To check logs and the status

prettysunshinez — Wed, 03 Jun 2020 08:12:53 GMT

Thanks @anthonymelita

I will try this.
But could yu pls explain how is relative time helping here.
Relative time is basically dependant on the time the search is run..
But in the above query,now() always takes the value of the current time the search is run and not on the time for which the search is run.