I have a dashboard that shows the status of certain logs reporting to Splunk. Within this dashboard, it also shows the last time an event was sent. Most of my log sources reports in 12 character Epoch time but I do have a few that reports in 18 character epoch time. For the ones that report in 18 characters, Splunk thinks that these events are happening in the future. Is there a way to fix this so that Splunk understands the 18 characters?
The source for the dashboard is the following:
| metadata index=* type=sourcetypes | stats max(lastTime) as lastEvent by sourcetype | convert ctime(*Event) | search sourcetype!="*too_small" | search ( **OMITTED** ) | eval LastEventEpoch = lastEvent | eval lastEventEpoch = strptime('lastEvent', "%m/%d/%Y %H:%M:%S") | eval nowEpoch=now() | eval diff = nowEpoch - lastEventEpoch| eval diff=if(diff>0, diff, 0) | eval status=case(diff >= 1 AND diff <=1800, "RUNNING", diff > 1801, "DOWN", diff=0, "OFFLINE/EVENT IN THE FUTURE") | sort - status| rename sourcetype AS Sourcetype, lastEvent AS "Last Seen Event", status AS Status | table Sourcetype, "Last Seen Event", Status
Thanks for your help
↧