Single value last time yes or no

[mmoermans]

I'm trying to show a simple Yes (green) / No (red) on a dashboard based on a host not reporting for longer than 5 minutes. Seems to be a bit harder than I expected. What I've got:

index=index host=host
| stats latest(_time) as last_seen | eval duration_since = tostring(now() - last_seen, "duration") | eval stringtime=if(duration > "00:05:00", "Yes", "No") | table stringtime

But this shows "No" at all times, even though the host reported 1 second ago. What am I doing wrong?

[elliotproebstel]

I don't think Splunk can compare time strings like that. Try this:

index=index host=host 
| stats latest(_time) as last_seen 
| eval stringtime=if(relative_time(now(), "-5m")>last_seen, "No", "Yes") 
| table stringtime

[somesoni2]

I would avoid string comparison (in your if statement).

index=index host=host
 | stats latest(_time) as last_seen | eval duration_since = now() - last_seen | eval stringtime=if(duration >300, "Yes", "No") | table stringtime