Please provide a query that will show me the version of my forwarders and when they last shipped me data.
index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=(now()-lastTime)/60/60
| table host, last_seen_hours
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]
This removes the domain component of hostname to ensure a match between metrics and metadata host value.
index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=(now()-lastTime)/60/60
| table host, last_seen_hours
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]
This removes the domain component of hostname to ensure a match between metrics and metadata host value.
Curious about your use of dedup
and table
vs stats
. With this snippet replacing that section of your search:
| stats latest(version) as version latest(arch) as arch latest(os) as os latest(build) as build by hostname
| rex field=hostname "(?<hostname>[^\.]+)"
... the search takes about 15% less time for me. Not a huge savings, for sure, but still.
Any advantage to using depup
+ table
?
Yep thanks for the reminder. I normally use stats and have updated the query. I came up with the query this morning and post it on answers as a future reference for myself and others.