I''m using Splunk 6.6.3, Java API 22.214.171.124, Java 1.8.0_45, IntelliJ IDE.
I'm making part of a simple application that checks that a given system is actively logging, where the sourceType, hostname, and minutes back from present are being read from a database and become part of the query.
An equivalent search query that works as expected in Splunk GUI, with time set as "Last 60 minutes" would be:
sourcetype=WinEventLog:Security host=abcxyz | head 1
I'm working from the examples provided, but none seem to show multiple arguments i.e. sourcetype, host, time range. In the code below, if I set:
String mySearch = "search host="+ lsb.getSystem() + " "; // just a host String
Note: In the code below, the method minutesBackString() returns a String like: "2018-03-27T12:53:46.626-04:00"
Can someone suggest a combination that will give the equivalent result of the GUI search? Ideally I would specify the field list, but I can get by without that. Any suggestions very much appreciated. Please Ignore the boolean return for now - it will be dependent on the content returned by the query.
Could you please do the following
1) please check if the particular host log coming to mentioned sourcetype
2)please put only sourcetype in the java search as follow
Search sourcetype=WinEventLog:Security | stats count by host