This search produces the most recent timestamp for every host for aa specific index
| metadata type=hosts index=windows |
convert ctime(*Time) | table host
index recentTime
how can i break it down a level further by last tinme a host reported in for a given sourcetype and index?
eg
host index sourcetype recenttime host1 windows system 30/06/2014 04:55 host1 windows security 30/06/2014 05:15
There is no in-build metadata which gives this information grouped by index, sourcetype and host all.
You can try this to get the the timestamp of last written entry for index, sourcetype host combination. This is the fastest available search I believe for this requirement (other than @martin's which is specific to Splunk6).
|metasearch index=clm_transactions sourcetype=* host=* | stats max(_time) as recentTime by index sourcetype host
select appropriate time range for the search so that you can cover most of the host. It won't report for the hosts which have written any entries in given time range.
metadata type=hosts doesn't contain sourcetye information.
Check this
You may need different combinations. This link http://answers.splunk.com/tags/metadata/ has questions tagged with metadata. Some of these may help you.
|metasearch index=* sourcetype=* host=* | table index sourcetype host
This wont fetch recentTime
Hello Rob,
If you are on Splunk 6 @martin_mueller 's answer will help you get the info.
http://answers.splunk.com/answers/145995/alert-if-source-stops-indexing
Or
you can maintain a lookup table and make the comparison with metadata.
Thanks,
L