Splunk Search

search to find gaps in data?

r999
Path Finder

I have had some data reporting in from event logs from approx 30-40 windows servers.

There were some issues on some of the hosts over the past 3 months, which has led to some gaps in the data. (inputs.conf had "current_only = 1")

I intend to try and back fill those gaps via evt/evtx files but initially i would at least just like to know where and what data ranges there are prolonged gaps, say of more than 15 minutes from each host.

so to produce resuls like

host         from                   to
server1      19/10/2012 13:45:27    29/10/2012 09:45:27
server1      11/11/2012 17:25:32    12/11/2012 08:35:29
server2      31/10/2012 11:25:32    02/11/2012 18:22:22
etc....
Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Delta doesn't do grouping, so streamstats is your friend:

... | streamstats current=f last(_time) as last_time by host | eval gap = last_time - _time | where gap > 900 | convert ctime(last_time) as last_time | table _time last_time host

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Delta doesn't do grouping, so streamstats is your friend:

... | streamstats current=f last(_time) as last_time by host | eval gap = last_time - _time | where gap > 900 | convert ctime(last_time) as last_time | table _time last_time host
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...