Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Streamstats Question

$
0
0
Using this query below could you help me identify servers that were added on a daily basis? example today is friday 13th i would like to see new servers that were not on the report on the Thursday the 12th. Alternatively I would like to see servers that were removed. query - index=#### sourcetype=#### Name="####*"|table Name _time OS LastScanDate|eval Days=round((relative_time(now(),"@d")-relative_time(LastScanDate,"@d"))/86400,0)|eval LastScanDate=strftime(LastScanDate, "%Y-%m-%d")|sort by Name _time|streamstats window=1 current=f global=f values(LastScanDate) as prev|eval John=strftime(LastScanDate, "%d") Example Name _time OS LastScanDate Days prev Sever 1 2017-10-06T23:45:48.840-0500 Windows Server 2016 9/12/2017 31 ####WCAPPW1601 2017-10-07T23:45:15.257-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-08T23:45:53.773-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-08T23:50:59.393-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-09T23:45:11.293-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-10T23:45:15.580-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-11T23:45:37.297-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WCAPPW1601 2017-10-12T23:45:55.467-0500 Windows Server 2016 9/12/2017 31 9/12/2017 ####WDAPPBSO06B 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/14/2017 29 9/12/2017 ####WDAPPBSO06B 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/14/2017 29 9/14/2017 ####WDAPPBSO06B 2017-10-08T23:45:53.773-0500 Windows Server 2012 R2 9/14/2017 29 9/14/2017 ####WDAPPBSO06B 2017-10-08T23:50:59.393-0500 Windows Server 2012 R2 9/14/2017 29 9/14/2017 ####WDAPPBSO06B 2017-10-09T23:45:11.293-0500 Windows Server 2012 R2 9/14/2017 29 9/14/2017 ####WDAPPServer02A 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/19/2017 24 9/14/2017 ####WDAPPServer02A 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02A 2017-10-08T23:45:53.773-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02A 2017-10-08T23:50:59.393-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02A 2017-10-09T23:45:11.293-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-08T23:45:53.773-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-08T23:50:59.393-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02G 2017-10-09T23:45:11.293-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-08T23:45:53.773-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-08T23:50:59.393-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer02H 2017-10-09T23:45:11.293-0500 Windows Server 2012 R2 9/19/2017 24 9/19/2017 ####WDAPPServer03B 2017-10-06T23:45:48.840-0500 Windows Server 2012 R2 9/16/2017 27 9/19/2017 ####WDAPPServer03B 2017-10-07T23:45:15.257-0500 Windows Server 2012 R2 9/16/2017 27 9/16/2017

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>