topic How to Display the time when logs are not ingested? in Splunk Search

How to Display the time when logs are not ingested?

Karthikeyan — Tue, 31 May 2022 13:59:03 GMT

Hi Experts,

I'm new to splunk. I have created a dashboard to which logs are ingested every min and shows how many logs were ingested, as percentage i.e, on hourly basis it calculates the value as total. ingested logs/60.

However, in the drill-down part, I would like to show the actual timing when the logs were not ingested. Let me know if there is a mechanism to achieve this.

Regards, Karthikeyan

Re: Display the time when logs are not ingested

richgalloway — Tue, 31 May 2022 00:15:53 GMT

Finding something that is not there is not Splunk's strong suit, but you may be able to accomplish what you desire by searching for the logs and listing the times when nothing was reported. Fortunately, the timechart command will zero-fill time spans with no data. Try something like this:

<<your search for logs>> | timechart span=1m count | where count=0