Using an app generated log file, how to generate a search that will determine and visualize a host's running status?

[csprice]

I'll include the "Splunk newb here" disclaimer to start off with...

I have an agent that drops a new event every 50 - 55 seconds to a log file. I'm already pulling a few reports off this log, but what I'd like to do is use this log to tell if the agent is active. So far I have the following query (which I found on Answers):

index=my_index sourcetype=my_sourcetype
     | stats latest(_time) as latestTime by  host source 
     | eval latestTime=strftime(latestTime,"%x %X")

This gives me a table that displays host, source, and latest time an event was registered in that file.

What I'd like to do from here is perform an eval of some sort where if the latest time is older than 5m indicate the host that is missing is down. I'd like to display it... somehow. A pie chart was my initial thought.

Any help would be appreciated.

[richgalloway · Accepted solution]

Maybe this will help.

     index=my_index sourcetype=my_sourcetype
      | stats latest(_time) as latestTime by  host source 
      | eval status=if (now()-latestTime > 300, "Down", "Up")
      | eval latestTime=strftime(latestTime,"%x %X") | table host source status

[csprice]

Fantastic. Did exactly what I was after. Thank you!

[dmaislin_splunk]

| metadata type=hosts |where recentTime < now() - 300 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen