Getting Data In

Comparing the sourcetypes between certain period.

udayk1
Path Finder

I have a concern here, the requirement for me is to get a list of sourcetypes which are not sending logs from last 1month (say) and I have tried to take the list of last month active sourcetypes and this month, post on which I would do a 'vlookup' in the excel.
Yes, I agree this is manual, but the comparison is possible n Splunk as a query?

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi udayk1,

you can do this very easy in Splunk using the timewrap command. Take this run everywhere search command which compares the event counts for sourcetype=splunkd_access over the last 4 weeks:

index=_internal sourcetype=splunkd_access earliest=-3w@w | timechart count by sourcetype | timewrap w

Regarding your use case, a non-active sourcetype would be on this chart with count 0 if it stopped producing events within the last 4 weeks. If the sourcetype stopped 5 or 6 weeks ago you will have to extend the time range from weeks to month.

hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi udayk1,

you can do this very easy in Splunk using the timewrap command. Take this run everywhere search command which compares the event counts for sourcetype=splunkd_access over the last 4 weeks:

index=_internal sourcetype=splunkd_access earliest=-3w@w | timechart count by sourcetype | timewrap w

Regarding your use case, a non-active sourcetype would be on this chart with count 0 if it stopped producing events within the last 4 weeks. If the sourcetype stopped 5 or 6 weeks ago you will have to extend the time range from weeks to month.

hope this helps to get you started ...

cheers, MuS

linu1988
Champion

|metadata type=sourcetypes index=fmo*|where recentTime < now()-2592000|convert ctime(*Time)

before convert just use a where condition to check your requirement

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...