Query and Reporting

[revanthammineni]

Hi Everyone! I'm working on a report to find out the hosts that are not reporting logs. Since it's a huge data set, I'm using command metadata. This command is not allowing me to set up an alert based on time range values. Can anyone suggest me how to pass dynamic time values to the command metadata.

Below is my query.

|metadata type=hosts index=_internal splunk_server_group=* | fields host | join type=left host [|metadata index=os* type=hosts splunk_server_group=* ] | table host lastTime | eval reporting=case(isnull(lastTime), "no", 1=1, "yes") | eval time=strftime(lastTime,"%b %d %T %Y %Z")  |dedup host |where reporting="no"

Thanks in advance.

[richgalloway]

Try using tstats.

| tstats values(host) as host where index=_internal splunk_server_group=* 
| fields host 
| join type=left host 
    [| tstats values(host) as host, latest(_time) as lastTime where index=windows splunk_server_group=* ] 
| table host lastTime 
| eval reporting=case(isnull(lastTime), "no", 1=1, "yes") 
| eval time=strftime(lastTime,"%b %d %T %Y %Z") 
| dedup host
| where reporting="no"

[revanthammineni]

Thanks for the response.  I could see the lastTime provided by metadata is different to the last(_time) in tstats.

Giving me different results. Any idea, How we can get the metadata lastTime field using tstats?

Thanks.

[isoutamo]

Hi

if I recall right, you must use use “All time” with metadata to get real results. 
r. Ismo

[revanthammineni]

Yes. But I'm trying to set up an alerts. Command metadata not allowing me to dynamically pass time values. Also, tstats is not giving me the correct lastTime. 

[isoutamo]

From splunk slack: !missinghosts

There are a lot of options for finding hosts or sources that stop submitting events:
Meta Woot! https://splunkbase.splunk.com/app/2949/
TrackMe https://splunkbase.splunk.com/app/4621/
Broken Hosts App for Splunk https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts) https://splunkbase.splunk.com/app/3796/
Monitoring Console https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...

Some helpful posts:
https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe
https://www.duanewaddle.com/proving-a-negative/