I have this search string to identify certain events from extensions that stopped sending logs to Splunk, The specific event is below, I saw some examples using hosts, would it be possible instead of...
See more...
I have this search string to identify certain events from extensions that stopped sending logs to Splunk, The specific event is below, I saw some examples using hosts, would it be possible instead of hosts, certain fields in the log? In this specific example, the extension appears in the log, but I need to know if it is not within the 07 day period. index = raw_ramal EXTENSION: 11111111 (That number can be changed, there are thousands of it. The query below shows me the number of events of the extensions, but it does not help me to locate when any of them stopped having registration in the last 07 days. index=raw_ramal "EXTENSION:"
| rex field=_raw "EXTENSION:(?<EXTENSION>\+?\d+)"
| stats count by EXTENSION