Hai All,
from the below search how to convert secs to HH:MM format
age fields is getting time in secs
index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d
| eval Host=coalesce(hostname, sourceHost)
| eval age = (now() - _time )
| stats min(age) as age, max(_time) as LastTime by Host
| convert ctime(LastTime) as "Last Active On"
| eval Status= case(age < 1800,"Running",age > 1800,"DOWN") | rename age as Age
| sort Status | table Host, Status, Age,"Last Active On"
Hi Thanks,
this query i am using for to get UF status
but query taking long time if i am trying to filter status =DOWN
how we can modify this search fasten this query or how we can take time frame to get results
Hi @sekhar463,
if your search is slow there could be two issues:
for the first issue, you can accelerate your search in many ways, e.g. using a summary index.
For the second issue, remember that storage is the bottleneck of each Splunk system, and Splunk requires at least 800 (better 1200) IOPS for Hot and Warm Buckets, so the only solution is to use a faster storage.
Ciao.
Giuseppe
Hi @sekhar463,
you can use eval tostring:
index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d
| eval Host=coalesce(hostname, sourceHost)
| eval age=(now()-_time)
| stats
min(age) AS age
max(_time) AS LastTime
BY Host
| convert ctime(LastTime) AS "Last Active On"
| eval Status=if(age< 1800,"Running","DOWN")
| rename age AS Age
| eval Age=tostring(Age,"duration")
| sort Status
| table Host Status Age "Last Active On"
Ciao.
Giuseppe