Splunk Search

To check logs and the status

prettysunshinez
Explorer

Hi,
I would like to run a search,which gives me the list of host with status' - normal,warning and critical
Where Critical being logs not present in a host for 30 mins,warning - not present in 15 mins and but lesser than 30 mins and otherwise its normal.
Am facing 2 problems here,if a server has no logs for 2 days,and when i run a search today,my search is not showing up that host itself.
Another problem is that when change my time modifier to issue time,it is not showing the exact result.

Below is the query used.

index = abc* host=efg*
|stats latest(_time) as latest by host
|eval Status = case (latest <= relative_time(now(),"-15m") AND latest > relative_time(now(),"-30m"),"Warning",
latest <= relative_time(now(),"-30m"),"Critical",
true(),"Normal")
|eval Recent_Updated_Time = strftime(latest,"%c")

Kindly suggest

Tags (2)
0 Karma

anthonymelita
Contributor

Metadata search should be faster, and capture hosts without recent events. Otherwise you may need to use a lookup to define your list of hosts.

| metadata type=hosts index=abc*
| search host=efg*
| eval warn=relative_time(now(), "-15m")
| eval crit=relative_time(now(), "-30m")
| eval status=case(recentTime >= warn, "Normal", recentTime < warn AND recentTime >= crit, "Warning", recentTime < crit, "Critical", 1==1, "Undefined")
| table host recentTime status totalCount
| eval recentTime=strftime(recentTime, "%c") ]
0 Karma

prettysunshinez
Explorer

Thanks @anthonymelita

I will try this.
But could yu pls explain how is relative time helping here.
Relative time is basically dependant on the time the search is run..
But in the above query,now() always takes the value of the current time the search is run and not on the time for which the search is run.

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...