I have all the events logging from Linux were in the TIME_FORMAT = %d/%m/%y
and Windows events were in TIME_FORMAT = %m/%d/%y
. Now I need to list out all the Windows events which were logging into Splunk with the time format TIME_FORMAT = %m/%d/%y
.
By using the below search string, I am able to list out out all the indexes and their hosts and their sourcetypes. Now I need only the list of events with TIME_FORMAT = %m/%d/%y only.
| tstats values(host) AS Host, values(sourcetype) AS Sourcetype WHERE index=* by index
I guess there is no straight way to identify this.
you can try something like this,,
Below search gives you the list of host has windows operating system.
index=_internal source=*metrics.log os=Windows earliest=-1h@h | dedup host | table host
If the above list of servers are correct then run the below search to get the index, source, sourcetype details.
Overall Query
| tstats values(host) AS Host, values(sourcetype) AS Sourcetype WHERE index=* [search index=_internal source=*metrics.log os=Windows earliest=-1h@h | dedup host | table host] by index
Hope this will helps you.
I guess there is no straight way to identify this.
you can try something like this,,
Below search gives you the list of host has windows operating system.
index=_internal source=*metrics.log os=Windows earliest=-1h@h | dedup host | table host
If the above list of servers are correct then run the below search to get the index, source, sourcetype details.
Overall Query
| tstats values(host) AS Host, values(sourcetype) AS Sourcetype WHERE index=* [search index=_internal source=*metrics.log os=Windows earliest=-1h@h | dedup host | table host] by index
Hope this will helps you.
Thanks like in the same is there any search which gives the list of host has Linux operating system.
index=_internal source=*metrics.log (os=Linux OR os=AIX) earliest=-1h@h | dedup host | table host
Are you trying to change the output format or do you want to search for data in a particular format?
I want to search the date in particular format. like the date with timestamp format TIME_FORMAT = %m/%d/%y and not TIME_FORMAT = %d/%m/%y