Splunk Search

index and the sourcetypes in which the hosts have collected events, with the date of the first and last event on the spe

jtabilas
Loves-to-Learn Everything

on index=_internal I have to create two searches one on (report ) and one connected to the dashboard where the index and the sourcetypes have collected events, with the date of the first and last event on the specific sourcetypes, the searches must take into account the data already present in the lookup itself. With the search, we don't have to overwrite the lookup every time, making the very purpose of its creation fail, since the date of the first event is lost as soon as the searchable data go beyond the retention of the indexes. also with 2 lookup datasets, an old one we have, a new one we need to create. check between the old and the new. if the old recorded data is old, it is kept if the new data is among the oldest, it will be replaced.

 

below the oldlookup search /// // index="_internal" 
| stats count, earliest(_time) as first, latest(_time) as last by sourcetype, index, host 
| eval first = strftime(first, "%Y-%m-%d %H:%M:%S"), last = strftime(last, "%Y-%m-%d %H:%M:%S") 
| table host, index, sourcetype, first, last 
| rename first as "first event", last as "last event" 
| sort - "first event" 
| outputlookup old
.csv

 

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

unfortunately I didn't get what is your question?

Anyhow you should change two first lines on your query to improve its performance. Try this

| tstats count, earliest(_time) as first, latest(_time) as last where index=_internal  by sourcetype, index, host 

instead of "index... | stats..."

There are lot of different apps which you could use to follow up if nodes are sending events or not on splunk base. One which could help you is TrackMe. Maybe not the eases to setup but it's quite capable for monitoring source hosts and individual logs.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...