topic NTP field extraction in Splunk Search

NTP field extraction

tevgey23 — Tue, 14 Aug 2012 18:48:49 GMT

Hello,

I wanted to know what would be the best way to extract the st (stratum) field from the
NTP event (in this case its 2). My goal is to get alerted when it turns 16 to notify my when NTP is out of sync

Here is the log as it gets indexed in splunk

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*192.168.1.25     124.16.150.20   2 u   56   64  377    0.249   16.252   6.991

host=hostname Options| sourcetype=ntp Options|

Thank you,

Re: NTP field extraction

dmaislin_splunk — Tue, 14 Aug 2012 19:20:36 GMT

yoursearch | rex "\d+.\d+.\d+.\d\s+\d+.\d+.\d+.\d\s+\s+(?\d+)

| multikv

This might just take the column headers and extract everything into the fields you need for you.

Re: NTP field extraction

tevgey23 — Tue, 14 Aug 2012 21:13:08 GMT

When I run the search I get the same results. Should I be inputting any other parameters ?

Re: NTP field extraction

amiracle — Mon, 22 Jul 2013 03:16:57 GMT

I was able to run the search using the multikv command and extracted the st field. Then, I simply added a where command to see if my servers had drifted. Here's the search:
index=timevaraince | multikv | where st > 16

I'm building a time variance app and should have it up on splunkbase soon.

Re: NTP field extraction

amiracle — Wed, 21 Aug 2013 14:16:17 GMT

Here's the app I built that helps you take apart the ntp output: http://apps.splunk.com/app/1567

It's called Time Variance and it simply takes the output and lets you have a simple dashboard that shows the overall time variances on your multiple servers. I hope this helps you out.

-K