Getting Data In
Highlighted

Query to return all forwarder versions and the last time that they sent data?

Champion

Please provide a query that will show me the version of my forwarders and when they last shipped me data.

Highlighted

Re: Query to return all forwarder versions and the last time that they sent data?

Champion
index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log 
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| join hostname [ | metadata type=hosts index=* 
| eval last_seen_hours=(now()-lastTime)/60/60 
| table host, last_seen_hours 
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

This removes the domain component of hostname to ensure a match between metrics and metadata host value.

View solution in original post

Highlighted

Re: Query to return all forwarder versions and the last time that they sent data?

Influencer

Curious about your use of dedup and table vs stats. With this snippet replacing that section of your search:

 | stats latest(version) as version latest(arch) as arch latest(os) as os latest(build) as build by hostname
 | rex field=hostname "(?<hostname>[^\.]+)"

... the search takes about 15% less time for me. Not a huge savings, for sure, but still.

Any advantage to using depup + table?

0 Karma
Highlighted

Re: Query to return all forwarder versions and the last time that they sent data?

Champion

Yep thanks for the reminder. I normally use stats and have updated the query. I came up with the query this morning and post it on answers as a future reference for myself and others.

0 Karma