Splunk Search

How to Display the time when logs are not ingested?

Karthikeyan
Engager

Hi Experts,

I'm new to splunk. I have created a dashboard to which logs are ingested every min and shows how many logs were ingested, as percentage i.e, on hourly basis it calculates the value as total. ingested logs/60. 

However, in the drill-down part, I would like to show the actual timing when the logs were not ingested. Let me know if there is a mechanism to achieve this.

Regards, Karthikeyan

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Finding something that is not there is not Splunk's strong suit, but you may be able to accomplish what you desire by searching for the logs and listing the times when nothing was reported.  Fortunately, the timechart command will zero-fill time spans with no data.  Try something like this:

<<your search for logs>>
| timechart span=1m count
| where count=0
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...