Splunk Search

To check logs and the status


I would like to run a search,which gives me the list of host with status' - normal,warning and critical
Where Critical being logs not present in a host for 30 mins,warning - not present in 15 mins and but lesser than 30 mins and otherwise its normal.
Am facing 2 problems here,if a server has no logs for 2 days,and when i run a search today,my search is not showing up that host itself.
Another problem is that when change my time modifier to issue time,it is not showing the exact result.

Below is the query used.

index = abc* host=efg*
|stats latest(_time) as latest by host
|eval Status = case (latest <= relative_time(now(),"-15m") AND latest > relative_time(now(),"-30m"),"Warning",
latest <= relative_time(now(),"-30m"),"Critical",
|eval Recent_Updated_Time = strftime(latest,"%c")

Kindly suggest

Tags (2)
0 Karma


Metadata search should be faster, and capture hosts without recent events. Otherwise you may need to use a lookup to define your list of hosts.

| metadata type=hosts index=abc*
| search host=efg*
| eval warn=relative_time(now(), "-15m")
| eval crit=relative_time(now(), "-30m")
| eval status=case(recentTime >= warn, "Normal", recentTime < warn AND recentTime >= crit, "Warning", recentTime < crit, "Critical", 1==1, "Undefined")
| table host recentTime status totalCount
| eval recentTime=strftime(recentTime, "%c") ]
0 Karma


Thanks @anthonymelita

I will try this.
But could yu pls explain how is relative time helping here.
Relative time is basically dependant on the time the search is run..
But in the above query,now() always takes the value of the current time the search is run and not on the time for which the search is run.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...