I need to know if a forwarder has not connected in the last 10 minutes.
What I really want to do is look for -->> now - lastConnected > 600 seconds
But I don't know how to find "now".
Instead I'm using :
all_forwarders
| sort - lastConnected | delta lastConnected AS forwarder_lag p=1 | fields sourceHost lastConnected forwarder_lag status | rename sourceHost as "Forwarder" sourceIp as "Source IP" connectionType as "Forwarder Type" lastConnected as "Last Connected" status as "Current Status" | fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p") | search forwarder_lag<-600
This works on the assumption that at least one of my forwarders is current connected. But it is not very elegant.
How do I find "now"?
Thanks.
Signed: Splunk Newbie
Well, "now" is available conveniently as now()
in an eval
operation - and also in a where
command (since where
derives some functionality from eval
). So, something like this may work (not I've not tested it):
`all_forwarders` | sort - lastConnected | delta lastConnected AS forwarder_lag p=1
| fields sourceHost lastConnected forwarder_lag status
| rename sourceHost as "Forwarder" sourceIp as "Source IP"
connectionType as "Forwarder Type" lastConnected as "Last Connected"
status as "Current Status"
| fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p")
| where forwarder_lag < (now()-600)
I am now satisfied with the DM and its alerting. So this has become moot. But like dwaddle's answer.
Awesome. Could you accept the answer then? (That way, it falls off the list of 'unanswered' posts .. and I get a little karma woo)
Well, "now" is available conveniently as now()
in an eval
operation - and also in a where
command (since where
derives some functionality from eval
). So, something like this may work (not I've not tested it):
`all_forwarders` | sort - lastConnected | delta lastConnected AS forwarder_lag p=1
| fields sourceHost lastConnected forwarder_lag status
| rename sourceHost as "Forwarder" sourceIp as "Source IP"
connectionType as "Forwarder Type" lastConnected as "Last Connected"
status as "Current Status"
| fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p")
| where forwarder_lag < (now()-600)
I know I will refer to this again. I'm so green it's painful. 😛 For now however, my DM seems to be behaving better/differently and is alerting me when my forwarders go silent pretty soon after they do so. So I think I'm good for now.
Thanks again for giving me a solution.