Splunk Search

Lost forwarder search case sensitive for host name

rgcox1
Communicator

When searching for lost forwarders a host with an all caps name is returned as lost when the same host with a lower case name is reporting. Not certain how host names are being changed, but is there a way to make the search insensitive to case for the host name?

Indexer is 4.1.2 and forwarders (lightweight) are 4.0.9 and 4.0.10.

| metadata type=hosts | tags | rename tag::host as tags |eval age = Round((now() - lastTime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | convert ctime(lastTime) | fields host,age,lastTime,tags
Tags (1)
0 Karma
2 Solutions

thall79
Communicator

Adding | eval host= lower(host) would cause all the host names to be lower case in your search string. Would that help?

| metadata type=hosts | eval host= lower(host) | tags | rename tag::host as tags |eval age = Round((now() - lastTime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | convert ctime(lastTime) | fields host,age,lastTime,tags

Travis.

View solution in original post

0 Karma

rgcox1
Communicator

Travis's answer is one part of the solution. In addition to "eval host=lower(host)" a pipe to "stats max(lastTime) as ltime by host" had to be added.

| metadata type=hosts | tags | rename tag::host as tags|eval host=lower(host) |stats max(lastTime) as ltime by host|eval age = Round((now() - ltime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | fields host,age

View solution in original post

rgcox1
Communicator

Travis's answer is one part of the solution. In addition to "eval host=lower(host)" a pipe to "stats max(lastTime) as ltime by host" had to be added.

| metadata type=hosts | tags | rename tag::host as tags|eval host=lower(host) |stats max(lastTime) as ltime by host|eval age = Round((now() - ltime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | fields host,age

thall79
Communicator

Adding | eval host= lower(host) would cause all the host names to be lower case in your search string. Would that help?

| metadata type=hosts | eval host= lower(host) | tags | rename tag::host as tags |eval age = Round((now() - lastTime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | convert ctime(lastTime) | fields host,age,lastTime,tags

Travis.

0 Karma

rgcox1
Communicator

No. The metadata record with the older lasttime still exists, so is still reported.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...