|
When searching for lost forwarders a host with an all caps name is returned as lost when the same host with a lower case name is reporting. Not certain how host names are being changed, but is there a way to make the search insensitive to case for the host name? Indexer is 4.1.2 and forwarders (lightweight) are 4.0.9 and 4.0.10. |
|
Travis's answer is one part of the solution. In addition to "eval host=lower(host)" a pipe to "stats max(lastTime) as ltime by host" had to be added. |
|
Adding | eval host= lower(host) would cause all the host names to be lower case in your search string. Would that help? | metadata type=hosts | eval host= lower(host) | tags | rename tag::host as tags |eval age = Round((now() - lastTime)/86400)| search age > 1 age < 60 host=srv* NOT tags=offline | sort age d | convert ctime(lastTime) | fields host,age,lastTime,tags Travis. No. The metadata record with the older lasttime still exists, so is still reported.
(13 May '10, 19:26)
rgcox1
|
