I wanted to know what would be the best way to extract the st (stratum) field from the
NTP event (in this case its 2). My goal is to get alerted when it turns 16 to notify my when NTP is out of sync
Here is the log as it gets indexed in splunk
remote refid st t when poll reach delay offset jitter
*192.168.1.25 126.96.36.199 2 u 56 64 377 0.249 16.252 6.991
host=hostname Options| sourcetype=ntp Options|
Here's the app I built that helps you take apart the ntp output: http://apps.splunk.com/app/1567
It's called Time Variance and it simply takes the output and lets you have a simple dashboard that shows the overall time variances on your multiple servers. I hope this helps you out.
I was able to run the search using the multikv command and extracted the st field. Then, I simply added a where command to see if my servers had drifted. Here's the search:
index=timevaraince | multikv | where st > 16
I'm building a time variance app and should have it up on splunkbase soon.