All Apps and Add-ons

*nix App macro question

hartfoml
Motivator

I was looking in the nix app today and ran the 'Failed_Logins_by_Host(*)' Macro

This macro expands to

remoteSearch litsearch index=os ( ( "failed login" OR "FAILED LOGIN" OR "Authentication failure" OR "Failed to authenticate user" OR "authentication ERROR" OR "Failed password for" ) ) host=* | addinfo type=count label=prereport_events | fields keepcolorder=t "*" "host" "index" "linecount" "prestats_reserved_*" "psrsvd_*" "source" "sourcetype" "splunk_server" | remotetl nb=300 et=1381338000.000000 lt=1381355354.000000 max_count=10000 | prestats count by host

My question is that I don't know what the term "remotetl" is used for in this search.

Anyone know what that term is used for?

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

This is part of the literal search that is dispatched to indexers. "remotetl" stands for remote timeline. When you look at this level of detail in the literal search, there is a lot that you will find that has no relevance to using the search language in practice but is important for the underlying search API.

View solution in original post

araitz
Splunk Employee
Splunk Employee

This is part of the literal search that is dispatched to indexers. "remotetl" stands for remote timeline. When you look at this level of detail in the literal search, there is a lot that you will find that has no relevance to using the search language in practice but is important for the underlying search API.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...