Splunk Search

NTP field extraction

tevgey23
Explorer

Hello,

I wanted to know what would be the best way to extract the st (stratum) field from the
NTP event (in this case its 2). My goal is to get alerted when it turns 16 to notify my when NTP is out of sync

Here is the log as it gets indexed in splunk

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*192.168.1.25     124.16.150.20   2 u   56   64  377    0.249   16.252   6.991

host=hostname Options| sourcetype=ntp Options|

Thank you,

Tags (1)
0 Karma

amiracle
Splunk Employee
Splunk Employee

Here's the app I built that helps you take apart the ntp output: http://apps.splunk.com/app/1567

It's called Time Variance and it simply takes the output and lets you have a simple dashboard that shows the overall time variances on your multiple servers. I hope this helps you out.

-K

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

yoursearch | rex "\d+.\d+.\d+.\d\s+\d+.\d+.\d+.\d\s+\s+(?\d+)

or

  • | multikv

This might just take the column headers and extract everything into the fields you need for you.

0 Karma

amiracle
Splunk Employee
Splunk Employee

I was able to run the search using the multikv command and extracted the st field. Then, I simply added a where command to see if my servers had drifted. Here's the search:
index=timevaraince | multikv | where st > 16

I'm building a time variance app and should have it up on splunkbase soon.

tevgey23
Explorer

When I run the search I get the same results. Should I be inputting any other parameters ?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...