Splunk Search

Metadata Command Alerting

ryangibson99
Explorer

Here's my command:

| metadata type=hosts index= | sort lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time

Now, I know that this might not be the most efficient command in the world, but I'm sort of a n00b. What I am now attempting to do from this is take resulting hosts who's "Latest_Time" > 24 hrs and alert on those hosts.

If you're wondering why I sorted twice, for some reason the way I built the command, it wasn't sorting properly, when I sorted again, it worked. Any help on this matter would be greatly appreciated.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Alert whenever this yields something:

| metadata type=hosts index=main | where relative_time(now(), "-1d") > lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...