Splunk Search

Search Help: Last time Windows Systems checked in by sourcetype

kholleran
Communicator

Hello,

I currently have a search that runs to show me the last time all my hosts checked in with Splunk.

However, I recently discovered that a system was not sending all the logs I wanted over for a reason (still) unknown. I'd like to modify this search to list the check-in by sourcetype but cannot seem to figure how to do it.

search: | metadata type=hosts | convert timeformat="%Y-%h-%d %l:%M:%S %p" ctime(lastTime) as last_update | table host,last_update | sort last_update

Thanks for your help.

Kevin

Tags (2)
0 Karma
1 Solution

Ayn
Legend

The metadata command can give you information on the last seen events for hosts, sources and sourcetypes, but not a combination of them. So you can certainly get last check-in by sourcetype (by specifying type=sourcetypes) but you cannot also get it split by host. In that case you'll have to resort to "classic" searches and use something like dedup host,sourcetype to get the latest events for each host/sourcetype pair.

View solution in original post

Ayn
Legend

The metadata command can give you information on the last seen events for hosts, sources and sourcetypes, but not a combination of them. So you can certainly get last check-in by sourcetype (by specifying type=sourcetypes) but you cannot also get it split by host. In that case you'll have to resort to "classic" searches and use something like dedup host,sourcetype to get the latest events for each host/sourcetype pair.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...