Splunk Search

How to get a list of sources that have not produced data for the last 24 hours for a particular index?

snehalk
Communicator

Hello All,

How can we get a list of sources which did not have any data for last 24 hours in Splunk for a particular index?

When am trying to use metadata, the result is coming from sourcetype, but not from the source. below is my search:

| metadata type=sourcetypes index=myindex | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")

Could you please help us on this?

0 Karma

alanden_splunk
Splunk Employee
Splunk Employee
| tstats count where index=myindex by source index
| tstats count where index=myindex by host source sourcetype index splunk_server
0 Karma

somesoni2
SplunkTrust
SplunkTrust

May be something like this

| metadata type=sources index=myindex | eval age=now()-recentTime | where age>86400 | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c") | fieldformat age=tostring(age,"duration")
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

I use the below, usually for hosts, but should work for sourcetypes, but not for sources...

 | metadata type=sourcetypes index=myindex
    | fields - totalCount,type
    | eval ageInSeconds = (now()- firstTime)
    | search ageInSeconds > 86400
    | convert ctime(lastTime) ctime(recentTime) ctime(firstTime)
    | table sourcetypes ageInSeconds lastTime recentTime | sort - ageInSeconds

Adjust the ageInSeconds to the time frame you want to check..

javiergn
SplunkTrust
SplunkTrust

Yes.

| metadata type=sources index=myindex
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...