Reporting

Splunk DB Connect: How to get a report of the latest event (device status) for each device in my database?

rameshlpatel
Communicator

Hi,

I have configured DB Connect to get latest data from database to get latest device status like Online/Offline. I have more then 12k devices and same data coming from the database each minute. At the time of creating the SPLUNK report, I have to find the latest event coming from each device to get latest device status.

Please could you help me how I can achieve this?

0 Karma

sanjay_shrestha
Contributor

You can create a scheduled saved search to create a lookup file

| dbquery "YOURDATABASE" "select * from  deviceinfo"|outputlookup device_status.csv

Then use it in your query

index=your_index .....|lookup device_status.csv device_id output device_status
0 Karma

rameshlpatel
Communicator

thanks Sanjay for your answer, however I am storing data in index as key-value pair and not using csv.

0 Karma

sanjay_shrestha
Contributor

you can try like this:

index=device_index... | join device_id [search index=yourdevicestatus_index|stats first(device_status)  by device_id]
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...