I am newbie in Splunk. I need help help creating a report to show new log sources that have been added to Splunk.
Hello @gcusello
Just want to know if you have a new suggestion that will fix my error
Hi @Narcisse,
you can run a simple search like the following:
| metadata index=* earliest=-30d@d latest=now
| stats
earliest(_time) AS earliest
latest(_time) AS latest
values(index) AS index
values(host) AS host
BY sourcetype
| where latest-earliest<86400
| eval
earliest=strftime(earliest,"%Y-%m-%d %H:%M:%S"),
latest=strftime(latest,"%Y-%m-%d %H:%M:%S")
In this way you can check the Data arrived in the last 24 hours not present in the previous 29 days.
Ciao.
Giuseppe
Thanks for your response but I am getting these messages
Error in 'metadata': You must specify a 'type' argument to 'metadata', as in 'type=hosts'.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
Hi @Narcisse,
please try this:
| tstats earliest(_time) AS earliest latest(_time) AS latest values(host) AS host WHERE earliest=-30d@d latest=now BY sourcetype index
| where latest-earliest<86400
| eval
earliest=strftime(earliest,"%Y-%m-%d %H:%M:%S"),
latest=strftime(latest,"%Y-%m-%d %H:%M:%S")
Ciao.
Giuseppe