Splunk Enterprise Security

How to narrow time frame for metadata search to only see events within a certain window?

tromero3
Path Finder

I have a metadata search to detect when host stops sending logs. I'd like to change the timeframe so that I only see the hosts where Last_Time_Reported is between 1 - 90 days ago, I do not want to see anything if last time reported was beyond that. When I change the time picker to 90 days, I am still seeing events way past 90 days prior. So I know that I need to change the query instead but I am not sure what exactly I should add. Can someone please help? Thank you!

| metadata type=hosts index=* | where relative_time(now(), "-1d") > lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | lookup assets.csv nt_host AS host OUTPUTNEW priority AS priority,bunit AS bunit | rename Latest_Time AS "Last Time Reported"

0 Karma
1 Solution

to4kawa
Ultra Champion
| where relative_time(now(), "-1d") > lastTime AND  lastTime > relative_time(now(), "-90d")  

the hosts where Last_Time_Reported is between 1 - 90 days ago
try this where

View solution in original post

0 Karma

to4kawa
Ultra Champion
| where relative_time(now(), "-1d") > lastTime AND  lastTime > relative_time(now(), "-90d")  

the hosts where Last_Time_Reported is between 1 - 90 days ago
try this where

0 Karma

tromero3
Path Finder

That worked! Thank you!!

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...