we want a search to execute every 20 minutes that looks at the past 20 minutes and ensures that events have been written to the log file by host.
This search returns no results.
sourcetype="PROD_PSI_HR_UNISYS_RTENGINE_DBG" | timechart count span=20m by host | where count=0
When I remove the "by host", the search below only works for a search for the past 4 hours but when I change it to 60 minutes, it stops returning results. It definitely doesn't work for the past 20 minutes.
sourcetype="PROD_PSI_HR_UNISYS_RTENGINE_DBG" | timechart count span=20m | where count=0
Any ideas?
If a host has no events, it will not be listed at all.
To proceed, you have to save a static list of the hosts, by example in a lookup file or a csv file. (See outputlookup, outputcsv, inputlookup, inputcsv)
and use this lookup as a | JOIN type=outer host
to populate the other results, then the missing hosts will be displayed.
see http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Join
here is an example with csv.
to generate the list once a week over all the week events :
earliest=-1w@w latest=@w | dedup host | stats count AS lastweek by host | outputcsv lastweekhostlist.csv
to use this list with last hour event list
earliest=-1h latest=now | dedup host | stats count AS today by host | JOIN type=outer host [ | inputcsv lastweekhostlist.csv ] | fillnull value=0 today lastweek | where lastweek>0 AND today=0
FYI, we use the dedup host to keep only 1 event per hosts to be faster, but you could remove it and use the actual count of events.
actually the timechart by host will return a table like :
timestamp host1 host2 host3
therefore there is not count columns to filter on.
try to replace by
| bucket _time span=20m | stats count by _time host
that will return a table like
timestamp count host
If a host has no events, it will not be listed at all.
To proceed, you have to save a static list of the hosts, by example in a lookup file or a csv file. (See outputlookup, outputcsv, inputlookup, inputcsv)
and use this lookup as a | JOIN type=outer host
to populate the other results, then the missing hosts will be displayed.
see http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Join
here is an example with csv.
to generate the list once a week over all the week events :
earliest=-1w@w latest=@w | dedup host | stats count AS lastweek by host | outputcsv lastweekhostlist.csv
to use this list with last hour event list
earliest=-1h latest=now | dedup host | stats count AS today by host | JOIN type=outer host [ | inputcsv lastweekhostlist.csv ] | fillnull value=0 today lastweek | where lastweek>0 AND today=0
FYI, we use the dedup host to keep only 1 event per hosts to be faster, but you could remove it and use the actual count of events.
sorry...lets forget the hosts problem...it's really the query sourcetype="PROD_PSI_HR_UNISYS_RTENGINE_DBG" | timechart count span=20m | where count=0 that's the problem