https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468288#M131841 <P>nope does not look at the time, does not retain the time comparison of the final_action events... have to rewrite...</P> Wed, 04 Sep 2019 20:54:48 GMT Glasses 2019-09-04T20:54:48Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468276#M131829 <P>Hi<BR /> Just not having luck with my syntax.<BR /> I have proofpoint logs and I am looking for the latest final_action value that is not equal to continue...<BR /> For example<BR /> <CODE>Index=Proofpoint sourcetype=mail_logs | stats latest(final_action)</CODE> gives me the last value... like if it was rejected or continued<BR /> The challenge I have is searching for latest <CODE>final_action != continue</CODE>... <BR /> The purpose here is that the final action can change from "discard" to "continue" so I want to filter on the "latest"...</P> <P>Any advice appreciated...</P> Wed, 30 Sep 2020 01:59:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468276#M131829 Glasses 2020-09-30T01:59:28Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468277#M131830 <P>try this :</P> <PRE><CODE>Index=Proofpoint sourcetype=mail_logs final_action!=continue | stats latest(final_action) </CODE></PRE> <P>OR </P> <PRE><CODE>Index=Proofpoint sourcetype=mail_logs | stats latest(eval(case(final_action!="continue",final_action))) as "final_action" </CODE></PRE> Wed, 04 Sep 2019 17:25:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468277#M131830 mayurr98 2019-09-04T17:25:33Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468278#M131831 <P>Thank you for the reply but neither are what I am looking for...<BR /> There are multiple events per email that contain "final_action", if an event with final_action=discard arrives at 10:41 another event for the same email can arrive later at 10:42 where final_action=continue, this is because there are a sequence of filters checking the email...<BR /> So I only want to find emails where the last or latest final_action!=continue...<BR /> Hope that makes sense... thank you</P> Wed, 30 Sep 2020 02:04:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468278#M131831 Glasses 2020-09-30T02:04:01Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468279#M131832 <P>what I am trying to do is use this <BR /> index=proofpoint sourcetype=mail "<EM>@somedomain.com" "connection.helo"="</EM>.somename.com"|stats latest(final_action) by msg.header.subject{} msg.header.to{} msg.header.from{}</P> <P>which gives me all the emails with the latest final_action value.... but now I need to filter out any final_action which is discard , reject etc... </P> <P>any advice appreciated... Thank you</P> Wed, 30 Sep 2020 02:04:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468279#M131832 Glasses 2020-09-30T02:04:16Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468280#M131833 <P>so you could add the <CODE>actions</CODE> that you want in the main search. final_action="discard" OR final_action="reject" OR...</P> Wed, 30 Sep 2020 02:03:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468280#M131833 mayurr98 2020-09-30T02:03:28Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468281#M131834 <P>apparently this works but I don't know if its the best way.... <CODE>index=proofpoint sourcetype=mail "@somedomain.com" "connection.helo"=".somename.com"|stats latest(final_action) by msg.header.subject{} msg.header.to{} msg.header.from{} |WHERE final_action!="continue"</CODE> </P> <P>if anyone can confirm or improve, it is much appreciated...</P> Wed, 04 Sep 2019 20:16:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468281#M131834 Glasses 2019-09-04T20:16:15Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468282#M131835 <P>This is the best way. </P> Wed, 04 Sep 2019 20:31:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468282#M131835 masonmorales 2019-09-04T20:31:31Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468283#M131836 <P>If you want to blacklist multiple final_actions, you could do:<BR /> <CODE>index=proofpoint sourcetype=mail "@somedomain.com" "connection.helo"=".somename.com"|stats latest(final_action) as final_action by msg.header.subject{} msg.header.to{} msg.header.from{} | search NOT final_action IN (continue, discard, reject)</CODE></P> Wed, 30 Sep 2020 02:03:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468283#M131836 masonmorales 2020-09-30T02:03:31Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468284#M131837 <PRE><CODE>index=proofpoint sourcetype=mail "@somedomain.com" "connection.helo"=".somename.com" final_action!="continue" |stats latest(final_action) by msg.header.subject{} msg.header.to{} msg.header.from{} </CODE></PRE> <P>this will be faster</P> Wed, 04 Sep 2019 20:39:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468284#M131837 mayurr98 2019-09-04T20:39:29Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468285#M131838 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/172209">@mayurr98</a> thank you but if I define final_action!=continue then I might not get the latest final_action values. Each email has more than one final_action but the last or latest one indicates where it continued to deliver or got dropped /discarded... I appreciate you stay with the thread though...</P> Wed, 30 Sep 2020 02:04:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468285#M131838 Glasses 2020-09-30T02:04:21Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468286#M131839 <P>then filtering at the end is the only option</P> Wed, 04 Sep 2019 20:50:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468286#M131839 mayurr98 2019-09-04T20:50:04Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468287#M131840 <P>my only improvement I might need is defining the latest(final_action) as FINAL so that it looks at the values for the latest... but IDK - still validating</P> <PRE><CODE>....| stats latest(final_action) as FINAL by _time msg.header.subject{} msg.header.to{} msg.header.from{} |WHERE FINAL!="continue" </CODE></PRE> Wed, 04 Sep 2019 20:50:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468287#M131840 Glasses 2019-09-04T20:50:10Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468288#M131841 <P>nope does not look at the time, does not retain the time comparison of the final_action events... have to rewrite...</P> Wed, 04 Sep 2019 20:54:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468288#M131841 Glasses 2019-09-04T20:54:48Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468289#M131842 <P>Final note, the issue is that proofpoint logs have multiple filters with multiple final actions and the logs don't have a absolutely final action or "delivered" or "not delivered" status in the message log. So I have to correlate a qid field from the message logs to the mta logs and check there if the email was sent... thank you everyone for you help.</P> Fri, 13 Sep 2019 13:12:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468289#M131842 Glasses 2019-09-13T13:12:40Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468290#M131843 <P>Thank you for the answer. This is a good example for blacklisting.</P> Fri, 13 Sep 2019 13:16:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-the-latest-field-value-that-is-not-equal-to-a/m-p/468290#M131843 Glasses 2019-09-13T13:16:07Z