Use TSTATS to find hosts no longer sending data

This is a simple tstats query shows all hosts and sourcetypes that have reported data, and shows the time in seconds since anything was sent. Be sure to run the query over a lengthy period of time in order to include machines that haven’t sent data for sometime. Don’t worry about the search-time so much, tstats is FAST!

Here’s the same query but with a rangemap:
And lastly, if you want to only know hosts that haven’t reported in for a period of time, you can use the following query utilizing the “where” function (example below shows anything that hasn’t sent data in over an hour):
Share This:

Leave A Comment?