search conditions applies for a particular log

[nagaraj]

Hi, Is there to way, when a particular host fails at certain point view in splunk? How this can be manipulated in splunk using search?

[chimell]

Hi nagaraj
Look at these two examples it will help you
1- The following search works finds all hosts who haven't sent a message in the last 24 hours

| metadata type=hosts | eval age = strftime("%s","now") - lastTime | search age > 86400 | sort age d | convert ctime(lastTime) | fields age,host,lastTime

2- What hosts (not forwarder/TCP inputs) have logged an event to Splunk in the last 10 minutes? (Including rangemap.)

| metadata type=hosts index=netops | eval diff=now()-recentTime | where diff < 600 | convert ctime(*Time) | stats count | rangemap field=count low=800-2000 elevated=100-799 high=50-99 server=0-49

[woodcock]

Something like this?

index=* err* OR warn* OR fatal | stats count by host