Solved: hosts not reporting - Splunk Community

Monitoring Splunk

I have following search. how can I add indexes information in the results:

|tstats max(_time) as _time, where index=windows by host,index
|append [|metadata type=hosts index=win index=linux ]
| eval now=now() | eval diff= now - lastTime | search diff > 18000 | eval notreportingsince=tostring(diff,"duration")
| table host lastTime notreportingsince | convert ctime(lastTime) as lastTime
| table host notreportingsince lastTime,index

1 Solution

Solution

Try something like this

|tstats max(_time) as _time, where index=windows [|metadata type=hosts index=win index=linux 
| eval now=now() | eval diff= now - lastTime | where diff > 18000 | table host ] by host,index

View solution in original post

hi @ITWhisperer , I just need a list of hosts which are not reporting since last 5 days along with index information.

Solution

Try something like this

|tstats max(_time) as _time, where index=windows [|metadata type=hosts index=win index=linux 
| eval now=now() | eval diff= now - lastTime | where diff > 18000 | table host ] by host,index

What is it that you are trying to achieve that metadata is not giving you?

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...