Splunk Search

NTP field extraction

Explorer

Hello,

I wanted to know what would be the best way to extract the st (stratum) field from the
NTP event (in this case its 2). My goal is to get alerted when it turns 16 to notify my when NTP is out of sync

Here is the log as it gets indexed in splunk

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*192.168.1.25     124.16.150.20   2 u   56   64  377    0.249   16.252   6.991

host=hostname Options| sourcetype=ntp Options|

Thank you,

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Here's the app I built that helps you take apart the ntp output: http://apps.splunk.com/app/1567

It's called Time Variance and it simply takes the output and lets you have a simple dashboard that shows the overall time variances on your multiple servers. I hope this helps you out.

-K

0 Karma

Splunk Employee
Splunk Employee

yoursearch | rex "\d+.\d+.\d+.\d\s+\d+.\d+.\d+.\d\s+\s+(?\d+)

or

  • | multikv

This might just take the column headers and extract everything into the fields you need for you.

0 Karma

Splunk Employee
Splunk Employee

I was able to run the search using the multikv command and extracted the st field. Then, I simply added a where command to see if my servers had drifted. Here's the search:
index=timevaraince | multikv | where st > 16

I'm building a time variance app and should have it up on splunkbase soon.

Explorer

When I run the search I get the same results. Should I be inputting any other parameters ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!