Splunk Search

Log sources not reporting in 24 hours

Ghanayem1974
Path Finder

anyone have an idea on how to write up a search that will provide details on which logsource stopped reporting for the last 24 hours?

Tags (1)
0 Karma

woodcock
Esteemed Legend

For hosts, like this (with very large timepicker value):

|metadata type=hosts
| eval age = now() - lastTime
| search age > 86400
0 Karma

pradeepkumarg
Influencer
|metadata type=sources | eval age = now() - lastTime | search age > 86400

Ghanayem1974
Path Finder

thank you but do you know if there is a way to separate out the devices that are not reporting? meaning, if its a windows server i want to the actual server that is not reporting. hope this makes sense.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...