How can I write a search to find lost connections with hosts?

[mpace]

Greetings,

I am using a syslog setup for my data source. I am trying to create a way to search for lost connection by comparing last event received to the time now. I have events that come in about every 1-2 secs, I need a way where I can run a real-time search for any time an event is greater than, Ex: 10 secs, and notify me when that happens. I am stuck on the syntax portion of writing this expression. I have tried

host="ip" compare=latest=-10s < timenow=now()

but I am pretty sure I have the syntax wrong.

Thanks
Mac

[somesoni2]

Try something like this

index=yourindex sourcetype=yoursource host="ip" | where (_time-now())>10 

[mpace]

Do I need to index=main sourcetype=generic_single_line host="ip" | where (_time-time()) > 10. Is the integer <10> in the units of seconds or milliseconds, or do I need to specify the integer as units of seconds <10s>. As of right now I do not receive results by changing time to 1 or .1

thanks

[somesoni2]

The _time and now() give time in epoch format (which is no of seconds after jan 01 1970. THere difference will be in seconds. ALso, the function to get current time is now() and not time().

[mpace]

I am still getting no results even when I unplug the device for test.