Change DM Missing Forwarder to look for forwarders that have not connected in last 10 minutes

[krussell101]

I need to know if a forwarder has not connected in the last 10 minutes.

What I really want to do is look for -->> now - lastConnected > 600 seconds

But I don't know how to find "now".

Instead I'm using :

all_forwarders | sort - lastConnected | delta lastConnected AS forwarder_lag p=1 | fields sourceHost lastConnected forwarder_lag status | rename sourceHost as "Forwarder" sourceIp as "Source IP" connectionType as "Forwarder Type" lastConnected as "Last Connected" status as "Current Status" | fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p") | search forwarder_lag<-600

This works on the assumption that at least one of my forwarders is current connected. But it is not very elegant.

How do I find "now"?

Thanks.

Signed: Splunk Newbie

[krussell101]

I am now satisfied with the DM and its alerting. So this has become moot. But like dwaddle's answer.

[dwaddle]

Awesome. Could you accept the answer then? (That way, it falls off the list of 'unanswered' posts .. and I get a little karma woo)

[dwaddle · Accepted solution]

Well, "now" is available conveniently as now() in an eval operation - and also in a where command (since where derives some functionality from eval). So, something like this may work (not I've not tested it):

`all_forwarders` | sort - lastConnected | delta lastConnected AS forwarder_lag p=1 
| fields sourceHost lastConnected forwarder_lag status 
| rename sourceHost as "Forwarder" sourceIp as "Source IP" 
connectionType as "Forwarder Type" lastConnected as "Last Connected" 
status as "Current Status" 
| fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p") 
| where forwarder_lag < (now()-600)

[krussell101]

I know I will refer to this again. I'm so green it's painful. 😛 For now however, my DM seems to be behaving better/differently and is alerting me when my forwarders go silent pretty soon after they do so. So I think I'm good for now.

Thanks again for giving me a solution.