When searching for lost forwarders a host with an all caps name is returned as lost when the same host with a lower case name is reporting. Not certain how host names are being changed, but is there a way to make the search insensitive to case for the host name?
Indexer is 4.1.2 and forwarders (lightweight) are 4.0.9 and 4.0.10.
| metadata type=hosts | tags | rename tag::host as tags |eval age = Round((now() - lastTime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | convert ctime(lastTime) | fields host,age,lastTime,tags
Adding | eval host= lower(host) would cause all the host names to be lower case in your search string. Would that help?
| metadata type=hosts | eval host= lower(host) | tags | rename tag::host as tags |eval age = Round((now() - lastTime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | convert ctime(lastTime) | fields host,age,lastTime,tags
Travis.
Travis's answer is one part of the solution. In addition to "eval host=lower(host)" a pipe to "stats max(lastTime) as ltime by host" had to be added.
| metadata type=hosts | tags | rename tag::host as tags|eval host=lower(host) |stats max(lastTime) as ltime by host|eval age = Round((now() - ltime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | fields host,age
Travis's answer is one part of the solution. In addition to "eval host=lower(host)" a pipe to "stats max(lastTime) as ltime by host" had to be added.
| metadata type=hosts | tags | rename tag::host as tags|eval host=lower(host) |stats max(lastTime) as ltime by host|eval age = Round((now() - ltime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | fields host,age
Adding | eval host= lower(host) would cause all the host names to be lower case in your search string. Would that help?
| metadata type=hosts | eval host= lower(host) | tags | rename tag::host as tags |eval age = Round((now() - lastTime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | convert ctime(lastTime) | fields host,age,lastTime,tags
Travis.
No. The metadata record with the older lasttime still exists, so is still reported.