Using the following search:
|metadata type=hosts |sort lastTime|convert ctime(lastTime)|fields host,lastTime
I am able to get a list of all hosts and when the last time splunk saw an event from that host. What I would like to do is create a saved search based off of this sort of search that I can use as an alert if lastTime is greater than some number of hours for any particular host. I was imagining something along the lines of
|metadata type=hosts |sort lastTime|convert ctime(lastTime)|fields host,lastTime |where NOW - lastTime > 12h
Or something along those lines. Is there a function that would give me NOW (current date/time) and if so, is this the right approach to get what I'm after?
You're looking for the now() function in eval. The following search will alert you if there are any hosts that haven't sent any data for more than one hour (3600 seconds)
# compare last event's time to now
|metadata type=hosts | eval since=now()-lastTime | search since>3600 |...
OR
# compare indexer's time when last event came to now
|metadata type=hosts | eval since=now()-recentTime| search since>3600 |...
You're looking for the now() function in eval. The following search will alert you if there are any hosts that haven't sent any data for more than one hour (3600 seconds)
# compare last event's time to now
|metadata type=hosts | eval since=now()-lastTime | search since>3600 |...
OR
# compare indexer's time when last event came to now
|metadata type=hosts | eval since=now()-recentTime| search since>3600 |...
Awesome, exactly what I was looking for. Thanks!