Getting Data In

Query to return all forwarder versions and the last time that they sent data?

the_wolverine
Champion

Please provide a query that will show me the version of my forwarders and when they last shipped me data.

1 Solution

the_wolverine
Champion
index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log 
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| join hostname [ | metadata type=hosts index=* 
| eval last_seen_hours=(now()-lastTime)/60/60 
| table host, last_seen_hours 
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

This removes the domain component of hostname to ensure a match between metrics and metadata host value.

View solution in original post

the_wolverine
Champion
index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log 
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| join hostname [ | metadata type=hosts index=* 
| eval last_seen_hours=(now()-lastTime)/60/60 
| table host, last_seen_hours 
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

This removes the domain component of hostname to ensure a match between metrics and metadata host value.

twinspop
Influencer

Curious about your use of dedup and table vs stats. With this snippet replacing that section of your search:

 | stats latest(version) as version latest(arch) as arch latest(os) as os latest(build) as build by hostname
 | rex field=hostname "(?<hostname>[^\.]+)"

... the search takes about 15% less time for me. Not a huge savings, for sure, but still.

Any advantage to using depup + table?

0 Karma

the_wolverine
Champion

Yep thanks for the reminder. I normally use stats and have updated the query. I came up with the query this morning and post it on answers as a future reference for myself and others.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...