Getting Data In

Is it possible to get field values from metadata results?

arrowecssupport
Communicator

I'm running a command to get a list of source types that haven't had data in 7 days, so in short, I'm looking for stuff that is no longer sending in data.

| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | convert ctime(lastTime)  | convert ctime(firstTime)  | convert timeformat="%Y %D" mktime(age) | fields source,firstTime, lastTime,age

Which returns records using meta data and the source name. Is it possible to search that further and get field values?

alt text

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

I'm confused about your question. You are saying you want a list of sourcetypes but you are then running a query that reports sources.
I've also noticed your age filter is wrong because age will be in seconds. In summary I would try the following query instead:

| metadata index=* type=sourcetypes  
| eval ageInDays = round((now()-lastTime)/86400)
| where ageInDays > 7 
| convert ctime(lastTime)  
| convert ctime(firstTime)  
| convert timeformat="%Y %D" mktime(ageInDays) 
| table sourcetype, firstTime, lastTime, ageInDays

If you also want to return some field values you can try something like:

| metadata index=* type=sourcetypes  
| eval ageInDays = round((now()-lastTime)/86400)
| where ageInDays > 7 
| table sourcetype, ageInDays
| map maxsearches=100 search="metasearch index=* sourcetype=$sourcetype$ | head 1"

Let me know if that helps

somesoni2
Revered Legend

What field values you're interested in?? If you want to look for actual events from that source, you can use result above as subsearch OR in a map command.

Subsearch

index=* [| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | table source ]

Map

| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | table source | map maxsearches=100 search="index=* source=$source$"
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!