Splunk Enterprise Security

i want to display the time intearval today and last 30 days i want to display the difference between these to days how we can wright query

mahendra559
New Member

| mstats c(System.System_Up_Time) as Uptime prestats=t WHERE index="em_metrics" AND host="*" by host,metric_name span=1m
| where Uptime < (now() - 2160000)
| eval diff=tostring(now() - Uptime,"duration")
| fields host Uptime diff
| sort – Uptime

getting no result
i have 2 hosts one host is coming metric log(System.System_Up_Time) other host is not coming so i want to display it as down

0 Karma

to4kawa
Ultra Champion

please try line by line.
getting no result
where?

| mstats c(System.System_Up_Time) as Uptime prestats=t WHERE index="em_metrics" AND host="*" by host,metric_name span=1m
| inputlookup append=t hostname.csv
| fillnull Uptime
| where Uptime < (now() - 2160000)
| eval diff=tostring(now() - Uptime,"duration")
| fields host Uptime diff
| sort – Uptime

hostname.csv

host
HostA
HostB

Like This?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...