How to find when index was last updated

[sivakumar28]

Hi All,

I have this query that runs 

| tstats latest(_time) as LatestEvent where index=* by index, host
| eval LatestLog=strftime(LatestEvent,"%a %m/%d/%Y %H:%M:%S")
| eval duration = now() - LatestEvent
| eval timediff = tostring(duration, "duration")
| lookup HostTreshold host
| where duration > threshold
| rename host as "src_host", index as "idx"
| fields - LatestEvent
| search NOT (index="cim_modactions" OR index="risk" OR index="audit_summary" OR index="threat_activity" OR index="endpoint_summary" OR index="summary" OR index="main" OR index="notable" OR index="notable_summary" OR index="mandiant")

The result is below

Now how do i add  index = waf_imperva . Thanks

Regards,

Roger

[sivakumar28]

The query should have the result of index = waf_imperva. However, the result is not there. How to I ensure to include waf_imperva in the query or how do I troubleshoot why not there? 

[ITWhisperer]

Start with this and look to see when you last got events for that index and which host or host is was.

| tstats latest(_time) as LatestEvent where index=waf_imperva by host

Then back track from there to figure out why you don't have any events

[ITWhisperer]

It is not clear what your expected result would look like - please can you explain further

[sivakumar28]

Do i need to include the IP address?

[ITWhisperer]

Which ip address?

Did you find out if you have any events in that index?

What timeframe did you search over?

[sivakumar28]

 Hi ITWhisperer

| tstats latest(_time) as LatestEvent where index=waf_imperva by host

15 min time frame

Host                      Count
10.30.168.10 1699663326

Why query below is not providing this result? My humble request for a struggling engineer, May I have your whatsup?

| tstats latest(_time) as LatestEvent where index=* by index, host
| eval LatestLog=strftime(LatestEvent,"%a %m/%d/%Y %H:%M:%S")
| eval duration = now() - LatestEvent
| eval timediff = tostring(duration, "duration")
| lookup HostTreshold host
| where duration > threshold
| rename host as "src_host", index as "idx"
| fields - LatestEvent
| search NOT (index="cim_modactions" OR index="risk" OR index="audit_summary" OR index="threat_activity" OR index="endpoint_summary" OR index="summary" OR index="main" OR index="notable" OR index="notable_summary" OR index="mandiant")

[ITWhisperer]

It looks like your host ip may not be in your lookup - please add the relevant information to the lookup.

[sivakumar28]

Hi @ITWhisperer ,

How do i do that? Any steps pls. Thanks.

Regards,

Siva Kumar

[ITWhisperer]

Edit your lookup file and reload it, or use outputlookup to overwrite/update it.