Hey guys.
I want to find hosts for all time which haven't any messages last 7 days, trying this:
index=main source=syslog | dedup host | table _time host | search latest=-7d
you should do this in two steps:
populate the lookup
| metasearch index=main source=syslog | dedup host | table host | outputlookup HostList.csv
(Obviously you have to create the lookup in which the column name is "host" before to execute this search)
check the host lookup
| inputlookup HostList.csv
| eval count=0
| eval host=upper(host)
| append [
|metasearch index=main latest=-7d
| eval host=upper(host)
| stats count by host
]
| stats sum(count) AS Total by host
| where Total=0
| table host
The result will be a list of hosts in the lookup that doesn't send any log in the last seven days.
You could have the same result putting the search used to populate the lookup in the second search (instead of |inputlookup ...), but if you have many events it will be very slow.
Try this.
Bye.
Giuseppe
You could just do a very long search (like last 6 months) like this:
index=main source=syslog | eval host=lower(host) | dedup host | table _time host | eval daysAgo=(now()-_time)/(60*60*24) | where daysAgo > 30
you should do this in two steps:
populate the lookup
| metasearch index=main source=syslog | dedup host | table host | outputlookup HostList.csv
(Obviously you have to create the lookup in which the column name is "host" before to execute this search)
check the host lookup
| inputlookup HostList.csv
| eval count=0
| eval host=upper(host)
| append [
|metasearch index=main latest=-7d
| eval host=upper(host)
| stats count by host
]
| stats sum(count) AS Total by host
| where Total=0
| table host
The result will be a list of hosts in the lookup that doesn't send any log in the last seven days.
You could have the same result putting the search used to populate the lookup in the second search (instead of |inputlookup ...), but if you have many events it will be very slow.
Try this.
Bye.
Giuseppe
thx for help!
i can't see difference between make output file for all time and make search with same parameter, so this request work fine for me:
index=main source=syslog | dedup host | table host
| eval count=0
| eval host=upper(host)
| append [
|metasearch index=main latest=-7d
| eval host=upper(host)
| stats count by host
]
| stats sum(count) AS Total by host
| where Total=0
| table host
It depends by the number of events: if you have many events it will be very slow!
Bye.
Giuseppe
and and you explain what difference between search and metasearch in subsearch?? thx
For metasearch see this http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Metasearch
but the importance is to use a lookup instead a search on a large time period.
Bye.
Giuseppe