hosts not reporting

[raiqb01]

I have following search. how can I add indexes information in the results:

|tstats max(_time) as _time, where index=windows by host,index
|append [|metadata type=hosts index=win index=linux  ]
| eval now=now() | eval diff= now - lastTime | search diff > 18000 | eval notreportingsince=tostring(diff,"duration")
| table host lastTime notreportingsince | convert ctime(lastTime) as lastTime
| table host notreportingsince lastTime,index

[raiqb01]

hi @ITWhisperer , I just need a list of hosts which are not reporting since last 5 days along with index information.

[ITWhisperer · Accepted solution]

Try something like this

|tstats max(_time) as _time, where index=windows [|metadata type=hosts index=win index=linux 
| eval now=now() | eval diff= now - lastTime | where diff > 18000 | table host ] by host,index

[ITWhisperer]

What is it that you are trying to achieve that metadata is not giving you?