Getting Data In

Is it possible to get field values from metadata results?

arrowecssupport
Communicator

I'm running a command to get a list of source types that haven't had data in 7 days, so in short, I'm looking for stuff that is no longer sending in data.

| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | convert ctime(lastTime)  | convert ctime(firstTime)  | convert timeformat="%Y %D" mktime(age) | fields source,firstTime, lastTime,age

Which returns records using meta data and the source name. Is it possible to search that further and get field values?

alt text

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

I'm confused about your question. You are saying you want a list of sourcetypes but you are then running a query that reports sources.
I've also noticed your age filter is wrong because age will be in seconds. In summary I would try the following query instead:

| metadata index=* type=sourcetypes  
| eval ageInDays = round((now()-lastTime)/86400)
| where ageInDays > 7 
| convert ctime(lastTime)  
| convert ctime(firstTime)  
| convert timeformat="%Y %D" mktime(ageInDays) 
| table sourcetype, firstTime, lastTime, ageInDays

If you also want to return some field values you can try something like:

| metadata index=* type=sourcetypes  
| eval ageInDays = round((now()-lastTime)/86400)
| where ageInDays > 7 
| table sourcetype, ageInDays
| map maxsearches=100 search="metasearch index=* sourcetype=$sourcetype$ | head 1"

Let me know if that helps

somesoni2
SplunkTrust
SplunkTrust

What field values you're interested in?? If you want to look for actual events from that source, you can use result above as subsearch OR in a map command.

Subsearch

index=* [| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | table source ]

Map

| metadata index=* type=sources  | eval age = now()-lastTime | where age > 7 | table source | map maxsearches=100 search="index=* source=$source$"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...