search to find gaps in data?

[r999]

I have had some data reporting in from event logs from approx 30-40 windows servers.

There were some issues on some of the hosts over the past 3 months, which has led to some gaps in the data. (inputs.conf had "current_only = 1")

I intend to try and back fill those gaps via evt/evtx files but initially i would at least just like to know where and what data ranges there are prolonged gaps, say of more than 15 minutes from each host.

so to produce resuls like

host         from                   to
server1      19/10/2012 13:45:27    29/10/2012 09:45:27
server1      11/11/2012 17:25:32    12/11/2012 08:35:29
server2      31/10/2012 11:25:32    02/11/2012 18:22:22
etc....

[martin_mueller · Accepted solution]

Delta doesn't do grouping, so streamstats is your friend:

... | streamstats current=f last(_time) as last_time by host | eval gap = last_time - _time | where gap > 900 | convert ctime(last_time) as last_time | table _time last_time host