Splunk Search

How to create timechart of events from servers that appeared last week, but not the last 24 hours?

yanivamram
Path Finder

Hi,
I have hundreds of servers that report to Splunk.
I would like to create a timechart that will include only events from servers that didn't report in last 24 hours (but did report in the past week).

What is the best way to do that?

Thanks,

Yaniv

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

| tstats count where index=yourindex AND
    [ tstats latest(_time) as latest where index=yourindex by host
    | where latest < relative_time(now(), "-24h") | fields host ]
  by _time host | timechart count by host

Run that over the last 7 days.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

| tstats count where index=yourindex AND
    [ tstats latest(_time) as latest where index=yourindex by host
    | where latest < relative_time(now(), "-24h") | fields host ]
  by _time host | timechart count by host

Run that over the last 7 days.

yanivamram
Path Finder

Thanks Martin,
It was very helpful 🙂

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Sure. Same strategy, except that - unless the field is indexed - you can't speed things up with tstats so it'd look like this:

index=yourindex sourcetype=yoursourcetype
  [ search index=yourindex sourcetype=yoursourcetype | stats latest(_time) as latest by ServerName | where latest < relative_time(now(), "-24h") | fields ServerName ]
| timechart count by ServerName

yanivamram
Path Finder

Thanks for the quick response.
I probably didn't explain myself properly 😞
I've a log collector that write a single log file from many servers, and this log reported to Splunk.
So the Server that I'm looking for is part of the event reported to Splunk(it is NOT the 'host' field).
The log will look like:
ServerName=

is that doable to search for all Servers that appeared in last week but doesn't appear in last 24H?

Thanks again,
Yaniv

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...