Hello,
Can someone please help me to build a query that will display hostname , IP address , last reported by the forwarder.
If i use the index= star host= star , that will be too much load on the indexers . Is there any better way to grab those metrics.
hey try this
| tstats max(_time) as lastReported WHERE index=* by host | eval LastReported=strftime(lastReported,"%m/%d/%y %H:%M:%S") | table LastReported host | join host [ search index=_internal hostname=* | stats count by sourceIp hostname | rename hostname as host]
Let me know if it works!
You can use tstats to get host and last reported by forwarder.
| tstats max(_time) as lastReported WHERE index=* by host
If you've dnslookup external lookup setup, you add that to above query to get the IP address.
Thank you for the reply. i have edited the query to convert epoch time to human readable format.Since we don't have external dnslookup , i am relying on internal index. But query couldn't display the sourceIP.
| tstats max(_time) as lastReported WHERE index=* by host | eval c_time=strftime(lastReported,"%m/%d/%y %H:%M:%S") | table c_time host | join [ search index=_internal hostname=* | stats count by sourceIp | table sourceIp ]