Getting Data In

Does host in one sourcetype gets updated or not?

SoknySplunk
Loves-to-Learn Lots

Does any body have search_query related sourcetype update that show:
- how many host in one sourcetype (increase/decrease host)?
- which host not update on time? Thanks

0 Karma

SoknySplunk
Loves-to-Learn Lots

By the way, could we use metadata to pull both host and source and last date?

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @soknysplunk,

Did the answer below solve your problem? If so, please resolve this post by approving it!

If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!

0 Karma

renjith_nair
Legend

@SoknySplunk,

Try this and lets know if it works for you

|tstats dc(host) as count  where (index=_* OR index=*) by host,sourcetype,_time
|eventstats latest(_time) as last_seen by host,sourcetype
|bucket span=1d _time|stats dc(host) as count,latest(last_seen) as last_seen by sourcetype,host,_time
|eval delay(secs)=now()-last_seen
|eventstats sum(count) as number_of_host by sourcetype
|table _time,sourcetype,host,number_of_host,delay(secs)|sort sourcetype
---
What goes around comes around. If it helps, hit it with Karma 🙂

inventsekar
SplunkTrust
SplunkTrust

Great query, Renjit.. upvoted!

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

SoknySplunk
Loves-to-Learn Lots

Thank you, it's a great example.

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...