Getting Data In

Last Time Heavy Forwarder received logs from it's Source


I've pieced together some SPL that shows me the last time the forwarder has sent its log data, but need to convert the  | eval Hour =relative_time(_time,"@h") to normal date-time format, i.e.  HH:MM:SS.  Any help is greatly appreciated! 

index=_internal sourcetype=splunkd group=tcpin_connections component=Metrics
| eval sourceHost=coalesce(hostname, sourceHost)
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| fillnull version value="pre 4.2"
| rename version as Ver  arch as MachType
| fields _time,connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver MachType
| eval Indexer= splunk_server
| eval Hour=relative_time(_time,"@h")
| stats avg(tcp_KBps) as avg_TCP_KBps avg(tcp_eps) as avg_TCP_eps sum(kb) as total_KB by Hour connectType sourceIp sourceHost MachType destPort Indexer Ver




Labels (1)
0 Karma


Hi @itsmevic ,

You can convert it using below at the end of your query;

| convert ctime(Hour)


If this reply helps you an upvote is appreciated. 

If this reply helps you an upvote is appreciated.
0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...