Splunk Search

finding the most recent sourcetype=hardware (similar to metadata command)

lemikg
Communicator

Hello everyone,

in my dashboard I have a table displaying the hardware configuration of a server and several other searches. So this is what I do, I pick a host, a timerange and hit search.
Depending on the timerange the desired table shows no results.

Is there a way to search for the most recent event of that stream / sourcetype=hardware where the hardware information was logged?

Thanks for your help.

regards
mike

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

You could increase your timerange and use |head 1. This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table.

In transforms.conf put:

[hardware]
filename = hardware.csv

Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data):

sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware

Then in your search you can do:

your_search | lookup hardware host | do_things_with_hardware

Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You could increase your timerange and use |head 1. This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table.

In transforms.conf put:

[hardware]
filename = hardware.csv

Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data):

sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware

Then in your search you can do:

your_search | lookup hardware host | do_things_with_hardware

Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

View solution in original post

0 Karma

lemikg
Communicator

i think this should do it, I will try this. thank you very much.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Well, you could use the timestamps in the metadata and do a second search.

|append [|metadata type=sourcetypes sourcetype=hardware|eval et=lastTime - (60*10)|convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(et) as et|map search="search sourcetype=hardware earliest=$et$|head 1"]

This will return the events of the sourcetype.

0 Karma

lemikg
Communicator

hi alacercogitatus, thanks for your reply. I was thinking of the lookup too and is probably the easiest way. I wanted to avoid increasing the timerange but Due to the number of searches in that particular view and userfriendliness I hoped to find another way of solving this.

From what I understand the metadata searches over time ie. indepently from the set timerange.

I was hoping to find something similar. Do you have something in that direction on your mind?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.