Splunk Search

How to incorporate metadata command in my lookup table to be able to view time offline?

chadman
Path Finder

I have a few searches I have added a lookup table to. All of them work, but one. The one below uses metadata and I'm not sure how to make it work with the lookup table. My goal it to find host that have not connected in the last 5 min.

| metadata  [| inputlookup Meeting_Rooms | fields host] | eval age = now()-lastTime | where age > 50  | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time"

This is not getting any results. If I replace [| inputlookup Meeting_Rooms | fields host] with type=hosts it works fine, but will show all host. Any ideas how I can make this work with my lookup table?

0 Karma
1 Solution

chadman
Path Finder

I think I have it working with this.

| inputlookup Meeting_Rooms | join type=left host [metadata type=hosts] | eval age = now()-lastTime | where age > 50  | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time"

View solution in original post

0 Karma

chadman
Path Finder

I think I have it working with this.

| inputlookup Meeting_Rooms | join type=left host [metadata type=hosts] | eval age = now()-lastTime | where age > 50  | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time"
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...