Hi, guys!
I have an event table, which has a field called "COD SERIE CEI". I need to get the "COD SERIE CEI" which has no events between now and 2 hours ago.
index="raw_arq_cei" Titulo="NCEI Informativas"
| eval eventHour=strftime(_time,"%H")
| eval eventMin=strftime(_time,"%M")
| eval curHour=strftime(now(),"%H")
| eval curMin=strftime(now(),"%M")
| table Dados.COD_SERIE_CEI
| sort _time
Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/
Another approach is to look back more than 2 hours (like 4 or even 24) and see if the most recent event has a timestamp older than 2 hours.
index="raw_arq_cei" Titulo="NCEI Informativas" earliest=-4h
| stats latest(_time) by Dados.COD_SERIE_CEI
| eval timeSince=now()-_time
| where timeSince > 7200
| sort _time
| table Dados.COD_SERIE_CEI
It's not clear what problem you are trying to solve. Are you looking for data that is at least 2 hours old or a lack or events in the last 2 hours or something else?
Hi Rich!
I edited my question.
I have an event table, which has a field called "COD SERIE CEI". I need to get the "COD SERIE CEI" which has no events between now and 2 hours ago.
Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/
Another approach is to look back more than 2 hours (like 4 or even 24) and see if the most recent event has a timestamp older than 2 hours.
index="raw_arq_cei" Titulo="NCEI Informativas" earliest=-4h
| stats latest(_time) by Dados.COD_SERIE_CEI
| eval timeSince=now()-_time
| where timeSince > 7200
| sort _time
| table Dados.COD_SERIE_CEI