Hello everyone,
in my dashboard I have a table displaying the hardware configuration of a server and several other searches. So this is what I do, I pick a host, a timerange and hit search.
Depending on the timerange the desired table shows no results.
Is there a way to search for the most recent event of that stream / sourcetype=hardware
where the hardware information was logged?
Thanks for your help.
regards
mike
You could increase your timerange and use |head 1
. This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table.
In transforms.conf put:
[hardware]
filename = hardware.csv
Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data):
sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware
Then in your search you can do:
your_search | lookup hardware host | do_things_with_hardware
Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup
You could increase your timerange and use |head 1
. This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table.
In transforms.conf put:
[hardware]
filename = hardware.csv
Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data):
sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware
Then in your search you can do:
your_search | lookup hardware host | do_things_with_hardware
Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup
i think this should do it, I will try this. thank you very much.
Well, you could use the timestamps in the metadata and do a second search.
|append [|metadata type=sourcetypes sourcetype=hardware|eval et=lastTime - (60*10)|convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(et) as et|map search="search sourcetype=hardware earliest=$et$|head 1"]
This will return the events of the sourcetype.
hi alacercogitatus, thanks for your reply. I was thinking of the lookup too and is probably the easiest way. I wanted to avoid increasing the timerange but Due to the number of searches in that particular view and userfriendliness I hoped to find another way of solving this.
From what I understand the metadata searches over time ie. indepently from the set timerange.
I was hoping to find something similar. Do you have something in that direction on your mind?