Getting Data In

Sourcetype not forwarding for 10 minutes

asarolkar
Builder

This is my stab at it:

| metadata type=hosts sourcetype="example" |  convert ctime(recentTime) as Recent_Time | where lastTime LESSTHANSYMBOL (now() - 600)

I am using this query - (now() - 600) translates to look between now and 10 minutes(600 seconds) before of now.

Does look ok ?

0 Karma

Lamar
Splunk Employee
Splunk Employee

This is probably closer to what you'll want:

| metadata type=sourcetypes | eval search_time=(now()-600) | eval status=if(lastTime<search_time, "NOT_OK", "OK") | table sourcetype, status

asarolkar
Builder

Fantastic ! This gives me across all sourcetypes

0 Karma

Lamar
Splunk Employee
Splunk Employee

You could easily translate this to a by 'host' search as well. Just change the word 'sourcetype' to 'host'.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>