Splunk Search

To check logs and the status


I would like to run a search,which gives me the list of host with status' - normal,warning and critical
Where Critical being logs not present in a host for 30 mins,warning - not present in 15 mins and but lesser than 30 mins and otherwise its normal.
Am facing 2 problems here,if a server has no logs for 2 days,and when i run a search today,my search is not showing up that host itself.
Another problem is that when change my time modifier to issue time,it is not showing the exact result.

Below is the query used.

index = abc* host=efg*
|stats latest(_time) as latest by host
|eval Status = case (latest <= relative_time(now(),"-15m") AND latest > relative_time(now(),"-30m"),"Warning",
latest <= relative_time(now(),"-30m"),"Critical",
|eval Recent_Updated_Time = strftime(latest,"%c")

Kindly suggest

Tags (2)
0 Karma


Metadata search should be faster, and capture hosts without recent events. Otherwise you may need to use a lookup to define your list of hosts.

| metadata type=hosts index=abc*
| search host=efg*
| eval warn=relative_time(now(), "-15m")
| eval crit=relative_time(now(), "-30m")
| eval status=case(recentTime >= warn, "Normal", recentTime < warn AND recentTime >= crit, "Warning", recentTime < crit, "Critical", 1==1, "Undefined")
| table host recentTime status totalCount
| eval recentTime=strftime(recentTime, "%c") ]
0 Karma


Thanks @anthonymelita

I will try this.
But could yu pls explain how is relative time helping here.
Relative time is basically dependant on the time the search is run..
But in the above query,now() always takes the value of the current time the search is run and not on the time for which the search is run.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...