Search Help: Last time Windows Systems checked in by sourcetype

[kholleran]

Hello,

I currently have a search that runs to show me the last time all my hosts checked in with Splunk.

However, I recently discovered that a system was not sending all the logs I wanted over for a reason (still) unknown. I'd like to modify this search to list the check-in by sourcetype but cannot seem to figure how to do it.

search: | metadata type=hosts | convert timeformat="%Y-%h-%d %l:%M:%S %p" ctime(lastTime) as last_update | table host,last_update | sort last_update

Thanks for your help.

Kevin

[Ayn · Accepted solution]

The metadata command can give you information on the last seen events for hosts, sources and sourcetypes, but not a combination of them. So you can certainly get last check-in by sourcetype (by specifying type=sourcetypes) but you cannot also get it split by host. In that case you'll have to resort to "classic" searches and use something like dedup host,sourcetype to get the latest events for each host/sourcetype pair.