You could do this:
| tstats count where index=yourindex AND
[ tstats latest(_time) as latest where index=yourindex by host
| where latest < relative_time(now(), "-24h") | fields host ]
by _time host | timechart count by host
Run that over the last 7 days.
You could do this:
| tstats count where index=yourindex AND
[ tstats latest(_time) as latest where index=yourindex by host
| where latest < relative_time(now(), "-24h") | fields host ]
by _time host | timechart count by host
Run that over the last 7 days.
Thanks Martin,
It was very helpful 🙂
Sure. Same strategy, except that - unless the field is indexed - you can't speed things up with tstats
so it'd look like this:
index=yourindex sourcetype=yoursourcetype
[ search index=yourindex sourcetype=yoursourcetype | stats latest(_time) as latest by ServerName | where latest < relative_time(now(), "-24h") | fields ServerName ]
| timechart count by ServerName
Thanks for the quick response.
I probably didn't explain myself properly 😞
I've a log collector that write a single log file from many servers, and this log reported to Splunk.
So the Server that I'm looking for is part of the event reported to Splunk(it is NOT the 'host' field).
The log will look like:
is that doable to search for all Servers that appeared in last week but doesn't appear in last 24H?
Thanks again,
Yaniv