Ingest to Splunk agent's last communication

[JKBH1]

Hi @cdinet, 

I was able to pull a query in ePO to view which devices have communicated to ePO within the past week. I noticed the exact date in LastUpdate is customized based on the query I ran. How would this work with Splunk integration though if that exact date is provided in the SQL query within Splunk? Basically, I would like us to run a query in Splunk to give me the data on which servers have communicated to ePO within the past week.

Could [EPOLeafNode].[LastUpdate] >= '2021-12-06T16:55:31.041' be written as

[EPOLeafNode].[LastUpdate] >= 'last week'

I'm not sure if this is possible since LastUpdate schema is below. Please help. Thank you.

datetime

8

Date/Time value indicating the last time the system successfully performed an agent-server communication sequence.

---

select count(*) as 'count', [BooleanPieChart_Alias].[ChartColor], [BooleanPieChart_Alias].[ChartColor] from ( select ( case when ( ( [EPOLeafNode].[LastUpdate] >= '2021-12-06T16:55:31.041' ) and ( dbo.EPOFN_CompareVersions([EPOProdPropsView_EPOAGENT].[productversion], '1', 'gte') = 1 ) ) then 1 when ( not ( ( [EPOLeafNode].[LastUpdate] >= '2021-12-06T16:55:31.041' ) and ( dbo.EPOFN_CompareVersions([EPOProdPropsView_EPOAGENT].[productversion], '1', 'gte') = 1 ) ) ) then 0 else -1 end ) as ChartColor from [EPOLeafNode] left join [EPOProdPropsView_EPOAGENT] on [EPOLeafNode].[AutoID] = [EPOProdPropsView_EPOAGENT].[LeafNodeID] where ( [EPOLeafNode].[LastUpdate] >= '2021-11-30T16:55:31.041' ) ) as BooleanPieChart_Alias group by [BooleanPieChart_Alias].[ChartColor] order by [BooleanPieChart_Alias].[ChartColor] desc

[cdinet]

No, last week is not a valid parameter to search on.  You would need to get with a dba or splunk for syntax,.  They can use a GETDATE() function, but I am not a dba and don't know how to configure that.  Maybe someone else does.

[JKBH1 · Accepted solution]

Thanks @cdinet, you're spot on with the GETDATA() func. I worked with a DBA and he recommended the below query to get the past seven days data:

"[LastUpdate] BETWEEN GETDATE()-7 AND GETDATE()"