Getting Data In
Highlighted

Identifying "idle" sources

Path Finder

How can I get a list of sources that haven't received any events for a given period of time (e.g. for last 24 hours). Purpose: alert Splunk admin if there are "idle" sources

Tags (1)
Highlighted

Re: Identifying "idle" sources

Motivator

You can use the following search to identify the last reported time of hosts:

| metadata type=hosts index=blah | sort recentTime desc | convert ctime(recentTime) as Recent_Time

And you can modify it to work on sources by changing hosts to sources:

| metadata type=sources index=blah | sort recentTime desc | convert ctime(recentTime) as Recent_Time
Highlighted

Re: Identifying "idle" sources

Motivator

To find sources that have checked in within the last week, but not within the last 24 hours:

| metadata sources
| eval age=now()-recentTime 
| where age>86400 and age<604800
| convert ctime(recentTime) as LastEvent

Tune the cutoff values (in seconds) in line 3 as needed.

Replace sources with hosts or sourcetypes if you want to report on those.

To evaluate for a specific source/sourcetype from a specific host, you would have to query the timestamps of raw events instead of using metadata (which can be much slower).

View solution in original post