I am trying to create a search that will display all universal forwarders that have not checked in for over 24 hours. Currently, what I have will display all of them and only show the time since check in if it is only over 24 hours. How do I remove the results that do not meet this?
Here's what I have so far:
index=_internal sourcetype=splunkd group=tcpin_connections
| stats latest(version) as version by hostname
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=case(((now()-lastTime)/60/60) > 1, (now()-lastTime)/60/60)
| table host, last_seen_hours
| rex field=host "(?[^.]+)" | fields - host ]
| sort last_seen_hours
Thank you for your help!
Just add | search last_seen_hours > 24 to filter:
index=_internal sourcetype=splunkd group=tcpin_connections
| stats latest(version) as version by hostname
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=case(((now()-lastTime)/60/60) > 1, (now()-lastTime)/60/60)
| search last_seen_hours > 24
| table host, last_seen_hours
| rex field=host "(?[^.]+)" | fields - host ]
| sort last_seen_hours
Just add | search last_seen_hours > 24 to filter:
index=_internal sourcetype=splunkd group=tcpin_connections
| stats latest(version) as version by hostname
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=case(((now()-lastTime)/60/60) > 1, (now()-lastTime)/60/60)
| search last_seen_hours > 24
| table host, last_seen_hours
| rex field=host "(?[^.]+)" | fields - host ]
| sort last_seen_hours
Thanks, that works. I ended up just tacking on "| where last_seen_hours > 24" to the end, as that's the solution I found first. I appreciate the help though!