finding the most recent sourcetype=hardware (similar to metadata command)

[lemikg]

Hello everyone,

in my dashboard I have a table displaying the hardware configuration of a server and several other searches. So this is what I do, I pick a host, a timerange and hit search.
Depending on the timerange the desired table shows no results.

Is there a way to search for the most recent event of that stream / sourcetype=hardware where the hardware information was logged?

Thanks for your help.

regards
mike

[alacercogitatus · Accepted solution]

You could increase your timerange and use |head 1. This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table.

In transforms.conf put:

[hardware]
filename = hardware.csv

Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data):

sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware

Then in your search you can do:

your_search | lookup hardware host | do_things_with_hardware

Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

[lemikg]

i think this should do it, I will try this. thank you very much.

[alacercogitatus]

Well, you could use the timestamps in the metadata and do a second search.

|append [|metadata type=sourcetypes sourcetype=hardware|eval et=lastTime - (60*10)|convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(et) as et|map search="search sourcetype=hardware earliest=$et$|head 1"]

This will return the events of the sourcetype.

[lemikg]

hi alacercogitatus, thanks for your reply. I was thinking of the lookup too and is probably the easiest way. I wanted to avoid increasing the timerange but Due to the number of searches in that particular view and userfriendliness I hoped to find another way of solving this.

From what I understand the metadata searches over time ie. indepently from the set timerange.

I was hoping to find something similar. Do you have something in that direction on your mind?