Search processing language

[EHariharan]

Hi Everyone,

Can any one help me with SPL to extract report of recent log sources reporting with time and the time difference from current time.

Thanks in Advance!

[chrisyounger]

Hi @EHariharan

This is a very hard problem, however the metawoot app does the best job of providing the sort of reports you want: https://splunkbase.splunk.com/app/2949/

Silly name, excellent app 🙂

All the best.

[EHariharan]

Thank you Chris.

But do i have any chance to extract report using query?

like adding some more query with following
* | stats values(source) by host

[chrisyounger]

Sorry I can't give you a simple answer. There are a lot of complexities becuase if you have time parsing problems, then the events won't show up in your search in the first place.