Splunk Enterprise

Query and Reporting

revanthammineni
Path Finder

Hi Everyone! I'm working on a report to find out the hosts that are not reporting logs. Since it's a huge data set, I'm using command metadata. This command is not allowing me to set up an alert based on time range values. Can anyone suggest me how to pass dynamic time values to the command metadata.

Below is my query.

|metadata type=hosts index=_internal splunk_server_group=* | fields host | join type=left host [|metadata index=os* type=hosts splunk_server_group=* ] | table host lastTime | eval reporting=case(isnull(lastTime), "no", 1=1, "yes") | eval time=strftime(lastTime,"%b %d %T %Y %Z")  |dedup host |where reporting="no"

Thanks in advance.

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using tstats.

| tstats values(host) as host where index=_internal splunk_server_group=* 
| fields host 
| join type=left host 
    [| tstats values(host) as host, latest(_time) as lastTime where index=windows splunk_server_group=* ] 
| table host lastTime 
| eval reporting=case(isnull(lastTime), "no", 1=1, "yes") 
| eval time=strftime(lastTime,"%b %d %T %Y %Z") 
| dedup host
| where reporting="no"
---
If this reply helps you, Karma would be appreciated.

revanthammineni
Path Finder

Thanks for the response.  I could see the lastTime provided by metadata is different to the last(_time) in tstats.

Giving me different results. Any idea, How we can get the metadata lastTime field using tstats?

Thanks.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if I recall right, you must use use “All time” with metadata to get real results. 
r. Ismo

0 Karma

revanthammineni
Path Finder

Yes. But I'm trying to set up an alerts. Command metadata not allowing me to dynamically pass time values. Also, tstats is not giving me the correct lastTime. 

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...