Splunk Search
Highlighted

Using an app generated log file, how to generate a search that will determine and visualize a host's running status?

Path Finder

I'll include the "Splunk newb here" disclaimer to start off with...

I have an agent that drops a new event every 50 - 55 seconds to a log file. I'm already pulling a few reports off this log, but what I'd like to do is use this log to tell if the agent is active. So far I have the following query (which I found on Answers):

index=my_index sourcetype=my_sourcetype
     | stats latest(_time) as latestTime by  host source 
     | eval latestTime=strftime(latestTime,"%x %X")

This gives me a table that displays host, source, and latest time an event was registered in that file.

What I'd like to do from here is perform an eval of some sort where if the latest time is older than 5m indicate the host that is missing is down. I'd like to display it... somehow. A pie chart was my initial thought.

Any help would be appreciated.

0 Karma
Highlighted

Re: Using an app generated log file, how to generate a search that will determine and visualize a host's running status?

Splunk Employee
Splunk Employee
| metadata type=hosts |where recentTime < now() - 300 | eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen
0 Karma
Highlighted

Re: Using an app generated log file, how to generate a search that will determine and visualize a host's running status?

SplunkTrust
SplunkTrust

Maybe this will help.

     index=my_index sourcetype=my_sourcetype
      | stats latest(_time) as latestTime by  host source 
      | eval status=if (now()-latestTime > 300, "Down", "Up")
      | eval latestTime=strftime(latestTime,"%x %X") | table host source status
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: Using an app generated log file, how to generate a search that will determine and visualize a host's running status?

Path Finder

Fantastic. Did exactly what I was after. Thank you!

0 Karma