Getting Data In

Last Time Heavy Forwarder received logs from it's Source


I've pieced together some SPL that shows me the last time the forwarder has sent its log data, but need to convert the  | eval Hour =relative_time(_time,"@h") to normal date-time format, i.e.  HH:MM:SS.  Any help is greatly appreciated! 

index=_internal sourcetype=splunkd group=tcpin_connections component=Metrics
| eval sourceHost=coalesce(hostname, sourceHost)
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| fillnull version value="pre 4.2"
| rename version as Ver  arch as MachType
| fields _time,connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver MachType
| eval Indexer= splunk_server
| eval Hour=relative_time(_time,"@h")
| stats avg(tcp_KBps) as avg_TCP_KBps avg(tcp_eps) as avg_TCP_eps sum(kb) as total_KB by Hour connectType sourceIp sourceHost MachType destPort Indexer Ver




Labels (1)
0 Karma


Hi @itsmevic ,

You can convert it using below at the end of your query;

| convert ctime(Hour)


If this reply helps you an upvote is appreciated. 

If this reply helps you an upvote is appreciated.
0 Karma