Hi Everyone,
Can any one help me with SPL to extract report of recent log sources reporting with time and the time difference from current time.
Thanks in Advance!
Hi @EHariharan
This is a very hard problem, however the metawoot app does the best job of providing the sort of reports you want: https://splunkbase.splunk.com/app/2949/
Silly name, excellent app 🙂
All the best.
Thank you Chris.
But do i have any chance to extract report using query?
like adding some more query with following * | stats values(source) by host
Sorry I can't give you a simple answer. There are a lot of complexities becuase if you have time parsing problems, then the events won't show up in your search in the first place.
