Dashboards & Visualizations

How to get spl to look for the latest timestamp for all the sourcetypes?

Deepz2612
Explorer

Hi,

i have a set of sourcetypes in a lookup.

Now my spl has to look for the latest timestamp for all the sourcetypes in the last one hour and report for the sourcetype for which the events are not available in the last one hour

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| metadata type=sourcetypes
| where lastTime < relative_time(now(),"-1h")
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Deepz2612,

if you haven't to check if there are events with sourcetypes not in the lookup, you could run something like this:

index=* [ | inputlookup your_lookup | fields sourcetype ]
| stats count BY sourcetype
| append [ | inputlookup your_lookup | eval count=0 | fields sourcetype count ] 
| stats sum(count) AS total BY sourcetype
| where total=0

You could also use tstats to have a more performant search:

| tstats count WHERE index=* BY sourcetype
| search [ | inputlookup your_lookup | fields sourcetype ]
| append [ | inputlookup your_lookup | eval count=0 | fields sourcetype count ] 
| stats sum(count) AS total BY sourcetype
| where total=0

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...