query for passive hosts to be removed?

40 Views Asked by At

Can someone please help me to remove passive hosts in splunk. the query i am using is:

| metadata type=hosts
| sort recentTime
| convert ctime(recentTime) as Latest
1

There are 1 best solutions below

0
On

You should compare the recentTime with the current time, work out the difference and compare the difference with a threshold to identify those hosts

Example query:

| metadata type=hosts | eval diff=now()-recentTime | eval threshold=3600 | where diff>threshold

Note: query not tested but you should get the idea