Can someone please help me to remove passive hosts in splunk. the query i am using is:
| metadata type=hosts
| sort recentTime
| convert ctime(recentTime) as Latest
Can someone please help me to remove passive hosts in splunk. the query i am using is:
| metadata type=hosts
| sort recentTime
| convert ctime(recentTime) as Latest
Copyright © 2021 Jogjafile Inc.
You should compare the recentTime with the current time, work out the difference and compare the difference with a threshold to identify those hosts
Example query:
Note: query not tested but you should get the idea