Getting Data In

Query to return all forwarder versions and the last time that they sent data?

the_wolverine
Champion

Please provide a query that will show me the version of my forwarders and when they last shipped me data.

1 Solution

the_wolverine
Champion
index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log 
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| join hostname [ | metadata type=hosts index=* 
| eval last_seen_hours=(now()-lastTime)/60/60 
| table host, last_seen_hours 
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

This removes the domain component of hostname to ensure a match between metrics and metadata host value.

View solution in original post

the_wolverine
Champion
index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log 
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| join hostname [ | metadata type=hosts index=* 
| eval last_seen_hours=(now()-lastTime)/60/60 
| table host, last_seen_hours 
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

This removes the domain component of hostname to ensure a match between metrics and metadata host value.

twinspop
Influencer

Curious about your use of dedup and table vs stats. With this snippet replacing that section of your search:

 | stats latest(version) as version latest(arch) as arch latest(os) as os latest(build) as build by hostname
 | rex field=hostname "(?<hostname>[^\.]+)"

... the search takes about 15% less time for me. Not a huge savings, for sure, but still.

Any advantage to using depup + table?

0 Karma

the_wolverine
Champion

Yep thanks for the reminder. I normally use stats and have updated the query. I came up with the query this morning and post it on answers as a future reference for myself and others.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...