topic Re: Search Help: Last time Windows Systems checked in by sourcetype in Splunk Search

Search Help: Last time Windows Systems checked in by sourcetype

kholleran — Mon, 28 Sep 2020 12:06:26 GMT

Hello,

I currently have a search that runs to show me the last time all my hosts checked in with Splunk.

However, I recently discovered that a system was not sending all the logs I wanted over for a reason (still) unknown. I'd like to modify this search to list the check-in by sourcetype but cannot seem to figure how to do it.

search: | metadata type=hosts | convert timeformat="%Y-%h-%d %l:%M:%S %p" ctime(lastTime) as last_update | table host,last_update | sort last_update

Thanks for your help.

Kevin

Re: Search Help: Last time Windows Systems checked in by sourcetype

Ayn — Tue, 17 Jul 2012 14:56:47 GMT

The metadata command can give you information on the last seen events for hosts, sources and sourcetypes, but not a combination of them. So you can certainly get last check-in by sourcetype (by specifying type=sourcetypes) but you cannot also get it split by host. In that case you'll have to resort to "classic" searches and use something like dedup host,sourcetype to get the latest events for each host/sourcetype pair.