I am using a syslog setup for my data source. I am trying to create a way to search for lost connection by comparing last event received to the time now. I have events that come in about every 1-2 secs, I need a way where I can run a real-time search for any time an event is greater than, Ex: 10 secs, and notify me when that happens. I am stuck on the syntax portion of writing this expression. I have tried
host="ip" compare=latest=-10s < timenow=now()
but I am pretty sure I have the syntax wrong.
Do I need to index=main sourcetype=genericsingleline host="ip" | where (_time-time()) > 10. Is the integer <10> in the units of seconds or milliseconds, or do I need to specify the integer as units of seconds <10s>. As of right now I do not receive results by changing time to 1 or .1
The _time and now() give time in epoch format (which is no of seconds after jan 01 1970. THere difference will be in seconds. ALso, the function to get current time is now() and not time().