NTP field extraction

[tevgey23]

Hello,

I wanted to know what would be the best way to extract the st (stratum) field from the
NTP event (in this case its 2). My goal is to get alerted when it turns 16 to notify my when NTP is out of sync

Here is the log as it gets indexed in splunk

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*192.168.1.25     124.16.150.20   2 u   56   64  377    0.249   16.252   6.991

host=hostname Options| sourcetype=ntp Options|

Thank you,

[amiracle]

Here's the app I built that helps you take apart the ntp output: http://apps.splunk.com/app/1567

It's called Time Variance and it simply takes the output and lets you have a simple dashboard that shows the overall time variances on your multiple servers. I hope this helps you out.

-K

[dmaislin_splunk]

yoursearch | rex "\d+.\d+.\d+.\d\s+\d+.\d+.\d+.\d\s+\s+(?\d+)

or

• | multikv

This might just take the column headers and extract everything into the fields you need for you.

[amiracle]

I was able to run the search using the multikv command and extracted the st field. Then, I simply added a where command to see if my servers had drifted. Here's the search:
index=timevaraince | multikv | where st > 16

I'm building a time variance app and should have it up on splunkbase soon.

[tevgey23]

When I run the search I get the same results. Should I be inputting any other parameters ?