Splunk Search
Highlighted

How can I search for logs from the last 24 hours in Splunk?

Communicator

Hi,

I am trying to display logs for last 24 hrs on Splunk. My search is:

index=peppol sourcetype=peppol-outbound | eval LastModtime=strftime(strptime(createDtTimeStamp,"%m-%d-%Y %H:%M:%S"),"%d/%Y/%m %p") | eval age=now()-recentTime | eval age=(age/3600) 

up to this much it is showing logs for the last 1 hour, but when I add in |where age>86400/3600 after eval age=(age/3600), it is showing nothing in results so please somebody guide me how to do this?

Thanks
Sunny


Update:
This is the latest thing I have done. I changed the search and get some better results, but it is showing logs for the last 3 days instead of showing the last 24hrs. Showing logs for the last 3 days at the time interval of 24hrs.

index=peppol sourcetype=peppol-outbound earliest=-1d@d | timechart span=24h count | eval LastModtime=strftime(strptime(createDtTimeStamp,"%m-%d-%Y %H:%M:%S"),"%d/%Y/%m %p")
0 Karma
Highlighted

Re: How can I search for logs from the last 24 hours in Splunk?

Motivator

Hmm. If earliest=-1d@d is giving you data from 3 days ago, it sounds like a data or onboarding problem. You should be able to use earliest=-24h to get data from 24 hours ago.

I'd suggest checking to make sure that:

  • the machine(s) providing the logs to Splunk have the correct date and time
  • the machine(s) providing the logs to Splunk are set in the correct timezone
  • the props.conf stanza for that input has the correct time zone setting
  • if using NTP, ensure that your NTP server is running, is correct, and can connect to the machine providing the logs to Splunk