Splunk Search

Metadata Command Alerting

ryangibson99
Explorer

Here's my command:

| metadata type=hosts index= | sort lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time

Now, I know that this might not be the most efficient command in the world, but I'm sort of a n00b. What I am now attempting to do from this is take resulting hosts who's "Latest_Time" > 24 hrs and alert on those hosts.

If you're wondering why I sorted twice, for some reason the way I built the command, it wasn't sorting properly, when I sorted again, it worked. Any help on this matter would be greatly appreciated.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Alert whenever this yields something:

| metadata type=hosts index=main | where relative_time(now(), "-1d") > lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...