Splunk Search

search to find gaps in data?

r999
Path Finder

I have had some data reporting in from event logs from approx 30-40 windows servers.

There were some issues on some of the hosts over the past 3 months, which has led to some gaps in the data. (inputs.conf had "current_only = 1")

I intend to try and back fill those gaps via evt/evtx files but initially i would at least just like to know where and what data ranges there are prolonged gaps, say of more than 15 minutes from each host.

so to produce resuls like

host         from                   to
server1      19/10/2012 13:45:27    29/10/2012 09:45:27
server1      11/11/2012 17:25:32    12/11/2012 08:35:29
server2      31/10/2012 11:25:32    02/11/2012 18:22:22
etc....
Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Delta doesn't do grouping, so streamstats is your friend:

... | streamstats current=f last(_time) as last_time by host | eval gap = last_time - _time | where gap > 900 | convert ctime(last_time) as last_time | table _time last_time host

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Delta doesn't do grouping, so streamstats is your friend:

... | streamstats current=f last(_time) as last_time by host | eval gap = last_time - _time | where gap > 900 | convert ctime(last_time) as last_time | table _time last_time host
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...