Splunk Search

How do I show the latest event for a sourcetype?

a212830
Champion

Hi,

I need to show a customer that their logs are appearing in Splunk, and want to list the host, sourcetype, and source, along with the most recent event (with a nice date) going back 7 days.

I can do most of it, but am having problems with the most recent event per sourcetype. I have the following:

index=euc_*  host=lyncqa*fe* |fields host, sourcetype, source |dedup host, sourcetype, source |table host, sourcetype, source

Can someone help me?

Tags (3)
0 Karma

maciep
Champion

tstats might be a faster option as well

| tstats latest(_time) as last where sourcetype=whatever | convert ctime(last)

lguinn2
Legend

This search is extremely fast, and can give you basic info about sourcetypes

| metadata type=sourcetypes index=euc

You can also run this search with type=hosts and type=sources. You could create a dashboard with 3 panels and have one search in each panel. The recentTime in the result is the latest time that Splunk indexed data from that sourcetype (or host or source). The lastTime is the timestamp of the most recent event. In large environments, the metadata command might not be completely accurate, though. This command will look back as many days as it can.

For the complete listing (which you could use the check the accuracy of the above technique), I would do this

index=euc_
| stats latest(_time) as latestTime by  host sourcetype source
| eval latestTime=strftime(latestTime,"%x %X")

Since you are only looking at one index, the metadata command will probably be accurate.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...