Finding Historical Gaps in Data

[neely_hpe]

I have an existing search that shows devices that currently are not logging i.e. gaps however, I didn't have an alert to fire if a new device was discovered. My question is how can I go back and see the actual gaps on devices from the past that are currently logging presently?

For example I know I had gaps from 12.30.18 up to 1.6.19 .. So how can I see or pull this historically?

Here is my search:

| metadata index=* type=hosts | where host="xxx.yyy.com" | eval gap = now()-lastTime | sort gap d | eval gap=tostring(gap, "duration") | convert ctime(lastTime) | fields host,lastTime,gap | rename gap as "Gap Duration (days+HH:MM:SS)" | rename lastTime AS "Last Time Event Was Seen By Data Source" | rename host AS "Data Source"

[dkeck]

HI,

I am not sure I get this right, you can always use| timechart count to see if there are gaps in your logs.

Since these gaps can be origined by delayed sending of your logs, your might be interessed in a delta as well.

You can get a delta with | eval delta= _indextime - _time