Splunk Search

How do I write the same search that populates the "Data Summary"?

samir_silva
New Member

I need the event data from the "Data Summary" because I need to create a search to find when hosts stop sending logs to our Splunk server via UDP syslog.

Thanks.

0 Karma
1 Solution

jmedved
Explorer

I'm pretty new to Splunk, but maybe this will help a bit. I think you need to use a metadata search. I have been using this to find dead log sources.

| metadata type=hosts index=mcafee | where recentTime < now() - 3600 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen 

Maybe you can modify that for your use case.

View solution in original post

jmedved
Explorer

I'm pretty new to Splunk, but maybe this will help a bit. I think you need to use a metadata search. I have been using this to find dead log sources.

| metadata type=hosts index=mcafee | where recentTime < now() - 3600 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen 

Maybe you can modify that for your use case.

samir_silva
New Member

Thank you so much jmedved,

I used this search and It's working very well.

Thank you so much again.

| metadata type=hosts index=* | where recentTime < now() - 3600 | eval "Ultimo Envio" = strftime(recentTime, "%F %T") |fields + host "Ultimo Envio" | search host!="10.244.68.15" host!="172.26.142.131" host!="172.26.142.129"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...