topic Re: Find Hosts which are not reporting in Splunk Search

Find Hosts which are not reporting

lohit — Mon, 28 Sep 2020 20:01:25 GMT

Hi All ,

I am trying to find the hosts which have not reported for the last 1 hour, so i am using metadata command.

I am using recentTime because it a loge stream.

Problem that i am facing is this metadata command shows me all hosts with recentTime before 1 hour. Attached is a screenshot for the same. Mu hosts have reported after that also. Even if i change the limit to 1 day then the search is showing me results for al hosts with recentTime before 1 day.

Any help !!

alt text

Re: Find Hosts which are not reporting

richgalloway — Thu, 21 May 2015 12:33:13 GMT

Your where clause is reversed. Using `...|where lastHour

Re: Find Hosts which are not reporting

lohit — Thu, 21 May 2015 13:02:35 GMT

Rich

Thanks but i think i am using right where clause. It states to check recentTime of hosts which have value of less than 1 hour.

Re: Find Hosts which are not reporting

jacobwilkins — Thu, 21 May 2015 13:28:07 GMT

How about hosts that we've seen as recently as yesterday, but have not reported in since the beginning of the last hour?

| metadata type=hosts  
| eval lastHour=relative_time(now(),"-1h@h") 
| eval yesterday=relative_time(now(), "-1d@d") 
| where ( recentTime>yesterday AND recentTime<lastHour) 
| eval sinceLast=tostring(now()-recentTime,"duration")

Adjust as needed.

Re: Find Hosts which are not reporting

richgalloway — Thu, 21 May 2015 14:46:30 GMT

My answer was chopped off. The recentTime and lastHour fields are timestamps, with lastHour set to one hour ago. Therefore, any timestamp bigger than lastHour is less than one hour old. That said, I think jacobwilkins has a good answer.

Re: Find Hosts which are not reporting

rameshyedurla — Thu, 21 Jan 2016 15:35:42 GMT

try this