Getting Data In

How do I constantly check the log if a connection is up or not?

timmag
Explorer

I have a host and source.
host="xyz" source="abc"

They give me results every minute whether the connection is up or not. My question is how do I write a query that continuously keeps checking the connection every minute and shows up if everything is fine and shows down if there is a connection fail for greater than 5 mins (i.e. the log would contain the connection is down 5 times)

0 Karma

splunker12er
Motivator
Makeresults| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>60
0 Karma

timmag
Explorer

I'm not sure I understood that. What is Makeresults?

0 Karma

splunker12er
Motivator

Make your results 🙂

Index=* host=hostname source=sourcename| above query

0 Karma

timmag
Explorer

Oopsy. Got it. But, I was getting this error: Error in 'tstats' command: This command must be the first command of a search... So I thought, that was something. 😛

0 Karma

timmag
Explorer

I still don't get it. Even if I try using simple stats command, it returns index error

0 Karma

MKowalewski
Engager

| makeresults [| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>60]
@timmag this sould work fine

0 Karma

p_gurav
Champion

You can use | metadata type=hosts and then select fields you want and apply condition.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...