Splunk Search

Search processing language

EHariharan
Explorer

Hi Everyone,

Can any one help me with SPL to extract report of recent log sources reporting with time and the time difference from current time.

Thanks in Advance!

Tags (1)

chrisyounger
SplunkTrust
SplunkTrust

Hi @EHariharan

This is a very hard problem, however the metawoot app does the best job of providing the sort of reports you want: https://splunkbase.splunk.com/app/2949/

Silly name, excellent app 🙂

All the best.

0 Karma

EHariharan
Explorer

Thank you Chris.

But do i have any chance to extract report using query?

like adding some more query with following
* | stats values(source) by host

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Sorry I can't give you a simple answer. There are a lot of complexities becuase if you have time parsing problems, then the events won't show up in your search in the first place.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...