Splunk Search

Query to find newly added sourcetypes

kteng2024
Path Finder

Hi,

I am using below query to find the newly added sourcetypes .

| metadata type=sourcetypes | eval time=now()-firstTime | where time

0 Karma
1 Solution

woodcock
Esteemed Legend

This tells you sourcetypes which are new in the last week ( 7 days):

| metadata type=sourcetypes 
| eval firstAgoSeconds=now()-firstTime 
| where firstAgoSeconds < (7 * 24 * 60 * 60)
| convert timeformat="%m-%d-%Y %H:%M:%S" ctime(firstTime) ctime(lastTime) ctime(recentTime)

View solution in original post

woodcock
Esteemed Legend
0 Karma

woodcock
Esteemed Legend

This tells you sourcetypes which are new in the last week ( 7 days):

| metadata type=sourcetypes 
| eval firstAgoSeconds=now()-firstTime 
| where firstAgoSeconds < (7 * 24 * 60 * 60)
| convert timeformat="%m-%d-%Y %H:%M:%S" ctime(firstTime) ctime(lastTime) ctime(recentTime)

vn_g
Path Finder

| metadata type=sourcetypes index="*"
| addinfo
| where (firstTime > info_min_time AND firstTime < info_max_time)

The above helps when you want to filter the value selected from TimeRangepicker.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...