hello all, I have a lookup with two fields sourcetype and interval ( like below) ..some of the intervals are in seconds (which is great) - However some are in cron like (14 01 * * *) --I need to change the ones in cron to 86400 ...Any ideas sourcetype interval blah 300 blah2 15 01 * * * * blah3 3600 blah4 18 02 * * * Here is my comically bad regex I've been working with, but cant seem to make it work | rest splunk_server=local /services/data/inputs/script | search (disabled = 0 AND interval=*) | dedup sourcetype | eval output=if(match(interval="(\d+)(\d+).(\d).(*).(*).(*)")),"86400","interval") | table sourcetype interval output Thanks! ... View more

Hey Splunkerinos, Noob Here. The code below tells us what sourcetypes haven't reported in, which is great and all.. However, I need to get a little deeper analysis to determine if we actually care about that sourcetype that hasnt reported in....To do that I need to get the INTERVALS for when these sourcetypes report ...for instance, if i havent heard from a sourcetype in 9 hours, (currently filtering to over a week, but you get my drift) but it only reports every ten hours, then i dont care and then I can blacklist it to keep it from showing up.......perhaps another lookup (multi-column) with sourcetype , interval, blacklist ...Not really sure how i would implement that though ...Thanks for your help ! | tstats latest(_indextime) as lt by host sourcetype | search NOT [inputlookup sourcetype_blacklist.csv | table sourcetype] | eval NOW=now() | eval difftime=NOW-lt | rangemap field=difftime "0 - 60 Min"=0-3600 "1 - 24 Hours"=3601-86400 "1-7 Days"=86401-604800 "1-2 Weeks"=604801-1209600 "2-3 Weeks"=1209601-1814400 default="Greater than 3 Weeks" | eventstats count(host) as tots_hosts by sourcetype | eventstats dc(sourcetype) as tots_st by host | search difftime >= 604801 | eventstats count(host) as ghost_hosts by sourcetype | eval percent_ghost_host = (ghost_hosts / tots_hosts) * 100 | eval percent_ghost_host=round(percent_ghost_host,2) | eventstats dc(sourcetype) as ghost_st by host | eval percent_ghost_st = (ghost_st / tots_st) * 100 | eval percent_ghost_st=round(percent_ghost_st,2) | dedup sourcetype | rename host as Host sourcetype as Sourcetype range as "Time Missing" percent_ghost_host as "This Hosts Percentage Missing to Whole" percent_ghost_st as "This Sourcetypes Percentage Missing to Whole" tots_hosts as "Total Count of Hosts by Sourcetype" tots_st as "Total Count of Sourcetypes by Host" ghost_hosts as "Count of Missing Hosts" ghost_st as "Count of Missing Sourcetypes" | table Host Sourcetype "Time Missing" "Total Count of Hosts by Sourcetype" "Count of Missing Hosts" "This Hosts Percentage Missing to Whole" "Total Count of Sourcetypes by Host" "Count of Missing Sourcetypes" "This Sourcetypes Percentage Missing to Whole" ... View more

Hey Splunksters, Noob here. The query below is for a dashboard panel that lets me toggle to see (for example) sourcetypes/ hosts that haven't sent data in 24 hours, but not more than 48 hours. It works, but its super slow. Any thoughts on the easiest way to speed this up? Perhaps a saved search? / loadjob? lookup? of so, what would the query for that look like???.. Any help is much appreciated! <form> <label>Missing Data Dashboard</label> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="simple"> <label>Select Period</label> <choice value="1">Missing 1 day</choice> <choice value="2">Missing 2 days</choice> <choice value="3">Missing 3 Days</choice> <choice value="4">Missing 4 Days</choice> <choice value="5">MIssing 5 Days</choice> <choice value="6">MIssing 6 Days</choice> <choice value="7">MIssing 7 Days</choice> <choice value="8">Missing 8 Days</choice> <choice value="9">Missing 9 Days</choice> <default>1</default> </input> <input type="dropdown" token="simple_2"> <label>Select Cutoff</label> <choice value="2">Not > 2 Days</choice> <choice value="3">Not > 3 Days</choice> <choice value="4">Not > 4 Days</choice> <choice value="5">Not > 5 Days</choice> <choice value="6">Not > 6 Days</choice> <choice value="7">Not > 7 Days</choice> <choice value="8">Not > 8 Days</choice> <choice value="9">Not > 9 Days</choice> <default>2</default> </input> </fieldset> <row> <panel> <title>Select Day for Silent Hosts / Sourcetypes (Last 15 Days)</title> <table> <search> <query>| tstats latest(_indextime) as lt by host sourcetype | eval timeLastSeenCheck=relative_time(now(), "-$simple$d@d"), newer_than=relative_time(now(), "-$simple_2$d@d") | eventstats count(host) as tots_hosts by sourcetype | eventstats dc(sourcetype) as tots_st by host | where lt < timeLastSeenCheck and lt>newer_than | eventstats count(host) as ghost_hosts by sourcetype | eval percent_ghost_host = (ghost_hosts / tots_hosts) * 100 | eventstats dc(sourcetype) as ghost_st by host | eval percent_ghost_st = (ghost_st / tots_st) * 100 | convert ctime(timeLastSeenCheck) as Time_LAst_Seen_Check timeformat="%Y/%m/%d %H:%M" | convert ctime(lt) as "Cutoff" timeformat="%Y/%m/%d %H:%M" | dedup sourcetype | rename host as Host sourcetype as Sourcetype percent_ghost_host as "This Hosts Percentage Missing to Whole" percent_ghost_st as "This Sourcetypes Percentage Missing to Whole" tots_hosts as "Total Count of Hosts by Sourcetype" tots_st as "Total Count of Sourcetypes by Host" ghost_hosts as "Count of Missing Hosts" ghost_st as "Count of Missing Sourcetypes" Time_LAst_Seen_Check as "Day Last Seen" | table Host Sourcetype "Total Count of Hosts by Sourcetype" "Count of Missing Hosts" "This Hosts Percentage Missing to Whole" "Total Count of Sourcetypes by Host" "Count of Missing Sourcetypes" "This Sourcetypes Percentage Missing to Whole" "Day Last Seen" "Cutoff"</query> <earliest>-15d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> <row> ... View more