I have two results of servers list as per last 30 days and last 12 hrs. I want to compare and find out which servers are not reporting in 12 hrs list. What can be the query for it.Little new in Splunk.
Hi,That worked wonderfully, but I'm not getting what type of output is coming lastreport as some 10 numbers of digit is coming in it.
lastreport will be an epoch time i.e. the number of seconds since the beginning of 1970. Use strftime to format how it is displayed
| fieldformat lastreport=strftime(lastreport,"%Y/%m/%d %H:%M:%S")
| stats latest(_time) as lastreport by server | where now()-lastreport > 12*60*60
