Splunk Search

Using an app generated log file, how to generate a search that will determine and visualize a host's running status?

csprice
Path Finder

I'll include the "Splunk newb here" disclaimer to start off with...

I have an agent that drops a new event every 50 - 55 seconds to a log file. I'm already pulling a few reports off this log, but what I'd like to do is use this log to tell if the agent is active. So far I have the following query (which I found on Answers):

index=my_index sourcetype=my_sourcetype
     | stats latest(_time) as latestTime by  host source 
     | eval latestTime=strftime(latestTime,"%x %X")

This gives me a table that displays host, source, and latest time an event was registered in that file.

What I'd like to do from here is perform an eval of some sort where if the latest time is older than 5m indicate the host that is missing is down. I'd like to display it... somehow. A pie chart was my initial thought.

Any help would be appreciated.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Maybe this will help.

     index=my_index sourcetype=my_sourcetype
      | stats latest(_time) as latestTime by  host source 
      | eval status=if (now()-latestTime > 300, "Down", "Up")
      | eval latestTime=strftime(latestTime,"%x %X") | table host source status
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Maybe this will help.

     index=my_index sourcetype=my_sourcetype
      | stats latest(_time) as latestTime by  host source 
      | eval status=if (now()-latestTime > 300, "Down", "Up")
      | eval latestTime=strftime(latestTime,"%x %X") | table host source status
---
If this reply helps you, Karma would be appreciated.

csprice
Path Finder

Fantastic. Did exactly what I was after. Thank you!

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee
| metadata type=hosts |where recentTime < now() - 300 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...