Getting Data In

query for searching passive hosts

Path Finder

Can someone please explain me what does the following query will do step by step ?

  type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time

thank you

0 Karma

SplunkTrust
SplunkTrust

That query is not valid. I believe the correct version would be

| metadata type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time

which retrieves a list of host names from the default indexes, sorts them from most-recently used to least-recently used, then converts the recentTime field from epoch format into text and renames it to Latest_Time.

---
If this reply helps you, an upvote would be appreciated.
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!