Find Hosts which are not reporting

[lohit]

Hi All ,

I am trying to find the hosts which have not reported for the last 1 hour, so i am using metadata command.

| metadata type=hosts | eval current=now()| eval lastHour=relative_time(now(),"-1h") | where lastHour > recentTime | convert ctime(current) as Current_Time, ctime(lastHour) as Last_Hour, ctime(recentTime) as Recent | table Current_Time,Last_Hour,Recent, host

I am using recentTime because it a loge stream.

Problem that i am facing is this metadata command shows me all hosts with recentTime before 1 hour. Attached is a screenshot for the same. Mu hosts have reported after that also. Even if i change the limit to 1 day then the search is showing me results for al hosts with recentTime before 1 day.

Any help !!

alt text

[jacobwilkins]

How about hosts that we've seen as recently as yesterday, but have not reported in since the beginning of the last hour?

| metadata type=hosts  
| eval lastHour=relative_time(now(),"-1h@h") 
| eval yesterday=relative_time(now(), "-1d@d") 
| where ( recentTime>yesterday AND recentTime<lastHour) 
| eval sinceLast=tostring(now()-recentTime,"duration") 

Adjust as needed.

[richgalloway]

Your where clause is reversed. Using `...|where lastHour

[lohit]

Rich

Thanks but i think i am using right where clause. It states to check recentTime of hosts which have value of less than 1 hour.

[rameshyedurla]

try this

|noop |append [ |metadata type=hosts | table *] | append [|metadata type=sourcetypes | table *] | eval t = now() - lastTime | eval name = coalesce(host,sourcetype)| table name t lastTime totalCount type |rename t as "Seconds since Event" | convert ctime(lastTime) timeformat="%m/%d/%Y %H:%M:%S"

[richgalloway]

My answer was chopped off. The recentTime and lastHour fields are timestamps, with lastHour set to one hour ago. Therefore, any timestamp bigger than lastHour is less than one hour old. That said, I think jacobwilkins has a good answer.