Splunk Search

Using an app generated log file, how to generate a search that will determine and visualize a host's running status?

csprice
Path Finder

I'll include the "Splunk newb here" disclaimer to start off with...

I have an agent that drops a new event every 50 - 55 seconds to a log file. I'm already pulling a few reports off this log, but what I'd like to do is use this log to tell if the agent is active. So far I have the following query (which I found on Answers):

index=my_index sourcetype=my_sourcetype
     | stats latest(_time) as latestTime by  host source 
     | eval latestTime=strftime(latestTime,"%x %X")

This gives me a table that displays host, source, and latest time an event was registered in that file.

What I'd like to do from here is perform an eval of some sort where if the latest time is older than 5m indicate the host that is missing is down. I'd like to display it... somehow. A pie chart was my initial thought.

Any help would be appreciated.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Maybe this will help.

     index=my_index sourcetype=my_sourcetype
      | stats latest(_time) as latestTime by  host source 
      | eval status=if (now()-latestTime > 300, "Down", "Up")
      | eval latestTime=strftime(latestTime,"%x %X") | table host source status
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Maybe this will help.

     index=my_index sourcetype=my_sourcetype
      | stats latest(_time) as latestTime by  host source 
      | eval status=if (now()-latestTime > 300, "Down", "Up")
      | eval latestTime=strftime(latestTime,"%x %X") | table host source status
---
If this reply helps you, Karma would be appreciated.

csprice
Path Finder

Fantastic. Did exactly what I was after. Thank you!

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee
| metadata type=hosts |where recentTime < now() - 300 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...