Splunk Search

How to Display the time when logs are not ingested?

Karthikeyan
Engager

Hi Experts,

I'm new to splunk. I have created a dashboard to which logs are ingested every min and shows how many logs were ingested, as percentage i.e, on hourly basis it calculates the value as total. ingested logs/60. 

However, in the drill-down part, I would like to show the actual timing when the logs were not ingested. Let me know if there is a mechanism to achieve this.

Regards, Karthikeyan

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit, but you may be able to accomplish what you desire by searching for the logs and listing the times when nothing was reported.  Fortunately, the timechart command will zero-fill time spans with no data.  Try something like this:

<<your search for logs>>
| timechart span=1m count
| where count=0
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...