Splunk Search
Highlighted

Find Hosts which are not reporting

Path Finder

Hi All ,

I am trying to find the hosts which have not reported for the last 1 hour, so i am using metadata command.

| metadata type=hosts | eval current=now()| eval lastHour=relativetime(now(),"-1h") | where lastHour > recentTime | convert ctime(current) as CurrentTime, ctime(lastHour) as LastHour, ctime(recentTime) as Recent | table CurrentTime,Last_Hour,Recent, host

I am using recentTime because it a loge stream.

Problem that i am facing is this metadata command shows me all hosts with recentTime before 1 hour. Attached is a screenshot for the same. Mu hosts have reported after that also. Even if i change the limit to 1 day then the search is showing me results for al hosts with recentTime before 1 day.

Any help !!

alt text

Tags (2)
0 Karma
Highlighted

Re: Find Hosts which are not reporting

SplunkTrust
SplunkTrust

Your where clause is reversed. Using `...|where lastHour

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Find Hosts which are not reporting

Path Finder

Rich

Thanks but i think i am using right where clause. It states to check recentTime of hosts which have value of less than 1 hour.

0 Karma
Highlighted

Re: Find Hosts which are not reporting

SplunkTrust
SplunkTrust

My answer was chopped off. The recentTime and lastHour fields are timestamps, with lastHour set to one hour ago. Therefore, any timestamp bigger than lastHour is less than one hour old. That said, I think jacobwilkins has a good answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Find Hosts which are not reporting

Explorer

try this

|noop |append [ |metadata type=hosts | table *] | append [|metadata type=sourcetypes | table *] | eval t = now() - lastTime | eval name = coalesce(host,sourcetype)| table name t lastTime totalCount type |rename t as "Seconds since Event" | convert ctime(lastTime) timeformat="%m/%d/%Y %H:%M:%S"

Highlighted

Re: Find Hosts which are not reporting

Communicator

How about hosts that we've seen as recently as yesterday, but have not reported in since the beginning of the last hour?

| metadata type=hosts  
| eval lastHour=relative_time(now(),"-1h@h") 
| eval yesterday=relative_time(now(), "-1d@d") 
| where ( recentTime>yesterday AND recentTime<lastHour) 
| eval sinceLast=tostring(now()-recentTime,"duration") 

Adjust as needed.