Splunk Search
Highlighted

How can I write a search to find lost connections with hosts?

New Member

Greetings,

I am using a syslog setup for my data source. I am trying to create a way to search for lost connection by comparing last event received to the time now. I have events that come in about every 1-2 secs, I need a way where I can run a real-time search for any time an event is greater than, Ex: 10 secs, and notify me when that happens. I am stuck on the syntax portion of writing this expression. I have tried

host="ip" compare=latest=-10s < timenow=now()

but I am pretty sure I have the syntax wrong.

Thanks
Mac

0 Karma
Highlighted

Re: How can I write a search to find lost connections with hosts?

SplunkTrust
SplunkTrust

Try something like this

index=yourindex sourcetype=yoursource host="ip" | where (_time-now())>10 
0 Karma
Highlighted

Re: How can I write a search to find lost connections with hosts?

New Member

Do I need to index=main sourcetype=genericsingleline host="ip" | where (_time-time()) > 10. Is the integer <10> in the units of seconds or milliseconds, or do I need to specify the integer as units of seconds <10s>. As of right now I do not receive results by changing time to 1 or .1

thanks

0 Karma
Highlighted

Re: How can I write a search to find lost connections with hosts?

SplunkTrust
SplunkTrust

The _time and now() give time in epoch format (which is no of seconds after jan 01 1970. THere difference will be in seconds. ALso, the function to get current time is now() and not time().

0 Karma
Highlighted

Re: How can I write a search to find lost connections with hosts?

New Member

I am still getting no results even when I unplug the device for test.

0 Karma