Splunk Search

When there are duplicate host names, how do you build a search that gets hosts' last activity?

CMSchelin
Path Finder

We have a bunch of hosts. Some of them are kind of like duplicates in that they are just the host name, and some are the FQDN. Example:

  • Server012
  • Server012.example.tld

I know how to use the metadata command to get a list of hosts and the last time they were seen. I also know how to strip out the domain part of the FQDN.

| metadata type=hosts
| rex field=host "^(?<hostname>.+)\.example.tld"
| table hostname, lastTime

The question is:

How can I collapse the duplicates and get the most recent most recent (sic) time?

Example data:

| host                  | lastTime   |
| Server012             | 1541663236 |
| Server012.example.tld | 1541689264 |

I want a query that would return:

| Server012 | 1541689264 |

Any insights?

0 Karma
1 Solution

KailA
Contributor

Hi @CMSchelin,

I think you can do something like that :

| metadata type=hosts
|rex field=host "^(?<hostname>.+)\.example.tld"
| table hostname, lastTime
| stats max(lastTime) as lastTime BY hostname

That will return you the most recent activity by host.

Let me know.
KailA 🙂

View solution in original post

KailA
Contributor

Hi @CMSchelin,

I think you can do something like that :

| metadata type=hosts
|rex field=host "^(?<hostname>.+)\.example.tld"
| table hostname, lastTime
| stats max(lastTime) as lastTime BY hostname

That will return you the most recent activity by host.

Let me know.
KailA 🙂

CMSchelin
Path Finder

Damn, all that typing for the question, and you answered it in like seconds. 🙂

That works perfectly, thank you!

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...