Create Search for a Host who dont send Data for x minutes in the last 10 Days

[mklhs]

Hello,

i wanted to write a search which will return all hosts which have not sent any events for 10 minutes in the last 10 days.
Normally the servers send every minute.

[mklhs · Accepted solution]

Hello Guys,

i got it with that query:

index= sourcetype= | eval age = (now() - _time ) | stats first(age) as age, first(_time) as LastTime by xxx | convert ctime(lastTime) as "Last Active On" | eval Status=case(age < 600, "running",age > 600,"Down"

with the last eval i have determined from when a server counts as not available for me

I hope it Helps someone

Thanks @renjith.nair

[renjith_nair]

@mklhs,

Try

    | metadata type=hosts where index=* OR index=_*|eval delay=round((now()-lastTime)/60)|where delay >10| fields host,delay

[mklhs]

Thank you!
but if I now have a time interval we say from last week Wednesday to yesterday how would I change the query? somehow that doesn't quite want to be me

[renjith_nair]

@mklhs,

Try this with time range

tstats count,max(_time) as _time where index=* by host | eval delay=(now()-_time)/60