I am trying to create a search that will display all universal forwarders that have not checked in for over 24 hours. Currently, what I have will display all of them and only show the time since check in if it is only over 24 hours. How do I remove the results that do not meet this?
Here's what I have so far:
index=_internal sourcetype=splunkd group=tcpin_connections
| stats latest(version) as version by hostname
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=case(((now()-lastTime)/60/60) > 1, (now()-lastTime)/60/60)
| table host, last_seen_hours
| rex field=host "(?[^.]+)" | fields - host ]
| sort last_seen_hours
Thank you for your help!
... View more