I have had some data reporting in from event logs from approx 30-40 windows servers.
There were some issues on some of the hosts over the past 3 months, which has led to some gaps in the data. (inputs.conf had "current_only = 1")
I intend to try and back fill those gaps via evt/evtx files but initially i would at least just like to know where and what data ranges there are prolonged gaps, say of more than 15 minutes from each host.
so to produce resuls like
host from to
server1 19/10/2012 13:45:27 29/10/2012 09:45:27
server1 11/11/2012 17:25:32 12/11/2012 08:35:29
server2 31/10/2012 11:25:32 02/11/2012 18:22:22