Splunk Search

finding the most recent sourcetype=hardware (similar to metadata command)

lemikg
Communicator

Hello everyone,

in my dashboard I have a table displaying the hardware configuration of a server and several other searches. So this is what I do, I pick a host, a timerange and hit search.
Depending on the timerange the desired table shows no results.

Is there a way to search for the most recent event of that stream / sourcetype=hardware where the hardware information was logged?

Thanks for your help.

regards
mike

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

You could increase your timerange and use |head 1. This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table.

In transforms.conf put:

[hardware]
filename = hardware.csv

Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data):

sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware

Then in your search you can do:

your_search | lookup hardware host | do_things_with_hardware

Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You could increase your timerange and use |head 1. This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table.

In transforms.conf put:

[hardware]
filename = hardware.csv

Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data):

sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware

Then in your search you can do:

your_search | lookup hardware host | do_things_with_hardware

Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

0 Karma

lemikg
Communicator

i think this should do it, I will try this. thank you very much.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Well, you could use the timestamps in the metadata and do a second search.

|append [|metadata type=sourcetypes sourcetype=hardware|eval et=lastTime - (60*10)|convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(et) as et|map search="search sourcetype=hardware earliest=$et$|head 1"]

This will return the events of the sourcetype.

0 Karma

lemikg
Communicator

hi alacercogitatus, thanks for your reply. I was thinking of the lookup too and is probably the easiest way. I wanted to avoid increasing the timerange but Due to the number of searches in that particular view and userfriendliness I hoped to find another way of solving this.

From what I understand the metadata searches over time ie. indepently from the set timerange.

I was hoping to find something similar. Do you have something in that direction on your mind?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...