Meta Woot! app: How does the search in this dashboard work?

[test_qweqwe]

I don't understand the part with eval (what we calculate and for what):

| inputlookup meta_woot  where index=* sourcetype=* host=*
| where recentTime<(now()-3600) 
| eval latency= round((recentTime-lastTime)/60,2)
| eval latency_type=if(latency<0,"Logging Ahead","Logging Behind") 
| eval latency=abs(latency)
| eval latency_type=if(latency="0.00","No Latency",latency_type)
| where latency>=0
| convert ctime(recentTime) ctime(firstTime) ctime(lastTime) ctime(lastUpdated) 
| rename latency AS "latency (mins)" 
| table index, sourcetype, host, firstTime, lastTime, recentTime, "latency (mins)",latency_type, lastUpdated 
| sort - "latency (mins)"

— — — — — — — — — — — — — — — — — — — — — — — —

And what mean:

| rest splunk_server=* /services/server/info

From savedsearches.conf

[Generate Meta Woot Server GUID Lookup]
disabled = 1
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
enableSched = 1
search = | rest splunk_server=* /services/server/info  | fields splunk_server, guid\
| outputlookup meta_woot_server_guid

For what we need fields splunk_server, guid?

[maciep · Accepted solution]

I haven't used the meta woot app, but i'll take a stab at this....

First off, i don't think those two searches are related. The first is using a lookup that I'm guessing is generated by the metadata command. The second is creating a lookup of splunk server names and their guids, which is probably used elsewhere in the app.

In the first search, recentTime represents the last time an event was indexed. The lastTime field represents the latest event timestamp the indexer knows about (as described in the metadata command). So based on those fields, the search is trying to determine if there is some sort of latency and in which direction. If the lastTime is after the recentTime, then there are probably events in the future, so it's logging ahead. if the lastTime is before the recentTime, then it could be behind. And to make it easier to read the latency in the output, it's getting the absolute value (abs), so that it's always positive. And of course, then just tabling/sorting to make it look nice.

The second search creates a lookup called meta_woot_server_guid that contains splunk server names and their guids. It only needs those two columns, so that's why it limits the results using fields. Like i said above, this lookup is probably used elsewhere in the app when converting from an ugly server guid, to a readable server name (or vice versa).

[gjanders]

In MetaWoot the "Meta Woot! License Volume Usage" page uses this lookup for the list of indexers.
It also uses this in one of the data models, so it's used elsewhere in the application as per maciep's answer.