Hi, Is there to way, when a particular host fails at certain point view in splunk? How this can be manipulated in splunk using search?
Hi nagaraj
Look at these two examples it will help you
1- The following search works finds all hosts who haven't sent a message in the last 24 hours
| metadata type=hosts | eval age = strftime("%s","now") - lastTime | search age > 86400 | sort age d | convert ctime(lastTime) | fields age,host,lastTime
2- What hosts (not forwarder/TCP inputs) have logged an event to Splunk in the last 10 minutes? (Including rangemap.)
| metadata type=hosts index=netops | eval diff=now()-recentTime | where diff < 600 | convert ctime(*Time) | stats count | rangemap field=count low=800-2000 elevated=100-799 high=50-99 server=0-49
Something like this?
index=* err* OR warn* OR fatal | stats count by host