Splunk Search

How can I search for logs from the last 24 hours in Splunk?

sunnyparmar
Communicator

Hi,

I am trying to display logs for last 24 hrs on Splunk. My search is:

index=peppol sourcetype=peppol-outbound | eval LastModtime=strftime(strptime(createDtTimeStamp,"%m-%d-%Y %H:%M:%S"),"%d/%Y/%m %p") | eval age=now()-recentTime | eval age=(age/3600) 

up to this much it is showing logs for the last 1 hour, but when I add in |where age>86400/3600 after eval age=(age/3600), it is showing nothing in results so please somebody guide me how to do this?

Thanks
Sunny


Update:
This is the latest thing I have done. I changed the search and get some better results, but it is showing logs for the last 3 days instead of showing the last 24hrs. Showing logs for the last 3 days at the time interval of 24hrs.

index=peppol sourcetype=peppol-outbound earliest=-1d@d | timechart span=24h count | eval LastModtime=strftime(strptime(createDtTimeStamp,"%m-%d-%Y %H:%M:%S"),"%d/%Y/%m %p")
0 Karma

wpreston
Motivator

Hmm. If earliest=-1d@d is giving you data from 3 days ago, it sounds like a data or onboarding problem. You should be able to use earliest=-24h to get data from 24 hours ago.

I'd suggest checking to make sure that:

  • the machine(s) providing the logs to Splunk have the correct date and time
  • the machine(s) providing the logs to Splunk are set in the correct timezone
  • the props.conf stanza for that input has the correct time zone setting
  • if using NTP, ensure that your NTP server is running, is correct, and can connect to the machine providing the logs to Splunk
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...