How can I get a list of sources that haven't received any events for a given period of time (e.g. for last 24 hours). Purpose: alert Splunk admin if there are "idle" sources
To find sources that have checked in within the last week, but not within the last 24 hours:
| metadata sources
| eval age=now()-recentTime
| where age>86400 and age<604800
| convert ctime(recentTime) as LastEvent
Tune the cutoff values (in seconds) in line 3 as needed.
Replace sources
with hosts
or sourcetypes
if you want to report on those.
To evaluate for a specific source/sourcetype from a specific host, you would have to query the timestamps of raw events instead of using metadata (which can be much slower).
To find sources that have checked in within the last week, but not within the last 24 hours:
| metadata sources
| eval age=now()-recentTime
| where age>86400 and age<604800
| convert ctime(recentTime) as LastEvent
Tune the cutoff values (in seconds) in line 3 as needed.
Replace sources
with hosts
or sourcetypes
if you want to report on those.
To evaluate for a specific source/sourcetype from a specific host, you would have to query the timestamps of raw events instead of using metadata (which can be much slower).
You can use the following search to identify the last reported time of hosts:
| metadata type=hosts index=blah | sort recentTime desc | convert ctime(recentTime) as Recent_Time
And you can modify it to work on sources by changing hosts to sources:
| metadata type=sources index=blah | sort recentTime desc | convert ctime(recentTime) as Recent_Time