Reporting

Creating a metadata report gives wrong date

EldadDor
Engager

I've found in the forum a nice way to query the metadata tables to check if our servers are writing logs,

the search term I'm using:

| metadata type=hosts index=distrib | eval mytime=strftime (recentTime, "%y-%m-%d %H:%M:%S") | eval currentTime=strftime(now(), "%y-%m-%d %H:%M:%S") | eval minutesAgo=round(((now()-recentTime)/60),0) | table sourcetype,host,lastTime,source,recentTime,mytime,currentTime,minutesAgo | where (abs(minutesAgo) > 1)

which works great, but when I'm using it as a report, the generated report gives
the current time as 70-01-01 02:00:00.
The TimeRange configured is

start time: rt-1m

finish time: rt

(I've tried some other time variations, but always got the same result)

(btw we're using Splunk 6)

Can you provide any help on the subject?

Tags (3)
0 Karma

EldadDor
Engager

Did the trick 🙂

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Use time() instead of now(). The latter gives you the time the search was launched, and can be trouble in certain constellations. Using time() will also self-update the timestamp over the potentially long-running realtime search.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...