How to create timechart of events from servers that appeared last week, but not the last 24 hours?

[yanivamram]

Hi,
I have hundreds of servers that report to Splunk.
I would like to create a timechart that will include only events from servers that didn't report in last 24 hours (but did report in the past week).

What is the best way to do that?

Thanks,

Yaniv

[martin_mueller · Accepted solution]

You could do this:

| tstats count where index=yourindex AND
    [ tstats latest(_time) as latest where index=yourindex by host
    | where latest < relative_time(now(), "-24h") | fields host ]
  by _time host | timechart count by host

Run that over the last 7 days.

[yanivamram]

Thanks Martin,
It was very helpful 🙂

[martin_mueller]

Sure. Same strategy, except that - unless the field is indexed - you can't speed things up with tstats so it'd look like this:

index=yourindex sourcetype=yoursourcetype
  [ search index=yourindex sourcetype=yoursourcetype | stats latest(_time) as latest by ServerName | where latest < relative_time(now(), "-24h") | fields ServerName ]
| timechart count by ServerName

[yanivamram]

Thanks for the quick response.
I probably didn't explain myself properly 😞
I've a log collector that write a single log file from many servers, and this log reported to Splunk.
So the Server that I'm looking for is part of the event reported to Splunk(it is NOT the 'host' field).
The log will look like:
ServerName=

is that doable to search for all Servers that appeared in last week but doesn't appear in last 24H?

Thanks again,
Yaniv