How to get the "COD SERIE CEI" which has no events between now and 2 hours ago?

[raultav]

Hi, guys!

I have an event table, which has a field called "COD SERIE CEI". I need to get the "COD SERIE CEI" which has no events between now and 2 hours ago.

index="raw_arq_cei" Titulo="NCEI Informativas"
| eval eventHour=strftime(_time,"%H")
| eval eventMin=strftime(_time,"%M")
| eval curHour=strftime(now(),"%H")
| eval curMin=strftime(now(),"%M")
| table Dados.COD_SERIE_CEI
| sort _time

[richgalloway]

It's not clear what problem you are trying to solve.  Are you looking for data that is at least 2 hours old or a lack or events in the last 2 hours or something else?

[raultav]

Hi Rich!

I edited my question.

I have an event table, which has a field called "COD SERIE CEI". I need to get the "COD SERIE CEI" which has no events between now and 2 hours ago.

[richgalloway · Accepted solution]

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

Another approach is to look back more than 2 hours (like 4 or even 24) and see if the most recent event has a timestamp older than 2 hours.

index="raw_arq_cei" Titulo="NCEI Informativas" earliest=-4h
| stats latest(_time) by Dados.COD_SERIE_CEI
| eval timeSince=now()-_time
| where timeSince > 7200
| sort _time
| table Dados.COD_SERIE_CEI