Getting Data In

How do I find when was the last time a particular source type was updated?

zacksoft
Contributor

I basically want to know how to figure out if Splunk isn't sending data and if my source/sourcetype has stale data.

Is there a type of mechanism where I can check if the last event present for the particular source is 15 minutes older and then generate an alert?

(In my case the data gets updated pretty frequently, so if the latest event's time stamp of a source is less than 15 minutes than current time then my charts and reports are showing old data).

Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @zacksoft,

You can metadata for command for this query. MOre information on metadata http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Metadata

For example below query will give you all sourcetypes which didn't sent data since last 15 minutes

| metadata type=sourcetypes | eval recent_Time=strftime(recentTime, "%d/%m/%Y %H:%M:%S") | eval lag=now() - recentTime | where lag > 900

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi @zacksoft,

You can metadata for command for this query. MOre information on metadata http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Metadata

For example below query will give you all sourcetypes which didn't sent data since last 15 minutes

| metadata type=sourcetypes | eval recent_Time=strftime(recentTime, "%d/%m/%Y %H:%M:%S") | eval lag=now() - recentTime | where lag > 900
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...