How do I find when was the last time a particular source type was updated?

[zacksoft]

I basically want to know how to figure out if Splunk isn't sending data and if my source/sourcetype has stale data.

Is there a type of mechanism where I can check if the last event present for the particular source is 15 minutes older and then generate an alert?

(In my case the data gets updated pretty frequently, so if the latest event's time stamp of a source is less than 15 minutes than current time then my charts and reports are showing old data).

[harsmarvania57 · Accepted solution]

Hi @zacksoft,

You can metadata for command for this query. MOre information on metadata http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Metadata

For example below query will give you all sourcetypes which didn't sent data since last 15 minutes

| metadata type=sourcetypes | eval recent_Time=strftime(recentTime, "%d/%m/%Y %H:%M:%S") | eval lag=now() - recentTime | where lag > 900