Splunk Search

How to create search to find the dates where the host is not sending logs to splunk?

Roy_9
Motivator

Hello,

I am trying to find the dates  when the host stopped sending logs to splunk in the last 6 months.I have used the below search but can only find the earliest and latest indexed time.

Just wanted to know the dates as well when the host stopped sending logs.

| tstats count as totalcount earliest(_time) as firstTime latest(_time) as lastTime where index=linux host=xyz by host
| fieldformat firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S")
| fieldformat lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")


Thanks

Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "added"? @ITWhisperer 's search should be run on its own, not added to your search.

Alternatively, you can try to count splitting by time so you can limit your search to a particular month or week (I think with a day resolution it could still run but go more densely and you won't visualize it reasonably).

| tstats prestats=t count where index=<your_index> host=<your_host> by _time span=1w
| timechart span=1w count

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| metasearch index=linux
| timechart count by host useother=f
| untable _time host count
| where count=0

Roy_9
Motivator

Hello @ITWhisperer 

I added the host name to the query provided and ran a search but i am not seeing any results under statistics tab. Is result=0 means that the host is reporting and that is the reason we are not seeing results?

Can you please confirm?

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct - if you are getting no results, all the hosts are reporting in the time period of your search.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "added"? @ITWhisperer 's search should be run on its own, not added to your search.

Alternatively, you can try to count splitting by time so you can limit your search to a particular month or week (I think with a day resolution it could still run but go more densely and you won't visualize it reasonably).

| tstats prestats=t count where index=<your_index> host=<your_host> by _time span=1w
| timechart span=1w count

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...