Getting Data In

Devices or sourcetypes not sednig logs

riqbal47010
Path Finder

Its a bit complicated query but let me explain.
One device=a start sending logs after 3 months. befor 3 months there was logs and LAST LOG/EVENT RECEIVED YESTERDAY.

So i want to see earliest, latest and difference between noew() and latest event.

dvc/host latestTime earliestTime daydiff
1 07/02/2019 09:40:55 04/04/2019 00:01:13 01/02/1970 07:27:59

below is my query:

index=xxx
| stats latest(_time) as latestTime, earliest(_time) as earliestTime by dvc
| convert ctime(latestTime) as latestTime, ctime(earliestTime) as earliestTime

and when I add below:

index=xxx
| stats latest(_time) as latestTime, earliest(_time) as earliestTime by dvc
| eval daydiff = (now()-latestTime)
| convert ctime(latestTime) as latestTime, ctime(earliestTime) as earliestTime, ctime(daydiff)

the daydiff field show the result = 01/01/1970

Tags (1)
0 Karma

adonio
Ultra Champion

try something like this if the device has the host filed. if not, convert to use stats

| tstats min(_time) as first_event max(_time) as last_event where index=* by host
| eval now_time = now() 
| eval gap_from_last_event = now_time - last_event
| eval first_human = strftime(first_event, "%c")
| eval last_human = strftime(last_event, "%c")
| eval HMS_diff = tostring(gap_from_last_event, "duration")

hope it helps

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...