Splunk Search

Query to check if log has not been updated in last 24 hours

AnmolKohli
Explorer

We have a requirement wherein we want to check if logs have not been updated in last 24 hours. There are around 20 indexes that we want to search on at the same time and each of those indexes gets data from 3 different hosts. Below is what we expect the output to be:

Index           Source  Host                     Last_Update_Time
Web_test    abc         prodpmwsv10   xyz
Web_test    abc         prodpmwsv11   mno
web_new    new1      prodpmwsv12   uip

We have used below query to achieve this but this just gives us the index and source. We want to include host as well as a part of the output.

Query-->

| eventcount summarize=false index=web_* | search NOT (index="web_rev3*" OR index="web_lgl" OR index="web_aqua")| dedup index | map maxsearches=100 search="| metadata type=sources index=\"$index$\" | eval index=\"$index$\""| eval age=now()-recentTime |search age>86400|convert ctime(recentTime)| eval age=round(age/3600, 2)|eval age=age+"hrs" |rename recentTime as "Last Update Time"| table index, source, "Last Update Time", age |sort -age| rename index as Index source as Source| rename age as "Hours since log was last updated"

Is there any way to do this? We tried to use another metadata command but that didn't help either.

Thanks.

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Run this over the last 7 or 30 days or so:

| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>86400 ...
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...