topic How to create timechart of events from servers that appeared last week, but not the last 24 hours? in Splunk Search

How to create timechart of events from servers that appeared last week, but not the last 24 hours?

yanivamram — Thu, 14 Aug 2014 20:11:05 GMT

Hi,
I have hundreds of servers that report to Splunk.
I would like to create a timechart that will include only events from servers that didn't report in last 24 hours (but did report in the past week).

What is the best way to do that?

Thanks,

Yaniv

Re: How to create timechart of events from servers that appeared last week, but not the last 24 hours?

martin_mueller — Thu, 14 Aug 2014 21:05:16 GMT

You could do this:

| tstats count where index=yourindex AND
    [ tstats latest(_time) as latest where index=yourindex by host
    | where latest < relative_time(now(), "-24h") | fields host ]
  by _time host | timechart count by host

Run that over the last 7 days.

Re: How to create timechart of events from servers that appeared last week, but not the last 24 hours?

yanivamram — Thu, 14 Aug 2014 21:34:32 GMT

Thanks for the quick response.
I probably didn't explain myself properly 😞
I've a log collector that write a single log file from many servers, and this log reported to Splunk.
So the Server that I'm looking for is part of the event reported to Splunk(it is NOT the 'host' field).
The log will look like:
ServerName=

is that doable to search for all Servers that appeared in last week but doesn't appear in last 24H?

Thanks again,
Yaniv

Re: How to create timechart of events from servers that appeared last week, but not the last 24 hours?

martin_mueller — Thu, 14 Aug 2014 21:47:35 GMT

Sure. Same strategy, except that - unless the field is indexed - you can't speed things up with tstats so it'd look like this:

index=yourindex sourcetype=yoursourcetype
  [ search index=yourindex sourcetype=yoursourcetype | stats latest(_time) as latest by ServerName | where latest < relative_time(now(), "-24h") | fields ServerName ]
| timechart count by ServerName

Re: How to create timechart of events from servers that appeared last week, but not the last 24 hours?

yanivamram — Sun, 17 Aug 2014 07:12:04 GMT

Thanks Martin,
It was very helpful 🙂