topic Re: Using latest timestamp in another search in Splunk Search

Using latest timestamp in another search

krylov — Fri, 17 Jan 2020 08:31:10 GMT

Good afternoon!

I need to do the following:
1. Using a search result that finds the last timestamp in a certain time interval, add it to another search № 2
index=status beamID=1 | stats latest(statustime)
2. Real-time search:
index = status beamID=1 time = "result of search №1" |
stats count(eval(terminalStatus="normal")) as NORMAL count(eval(terminalStatus="critical")) as CRITICAL count(eval(terminalStatus="pending-registration")) as PENDING-REGISTRATION count(eval(terminalStatus="unknown")) as UNKNOWN count(eval(terminalStatus="minor")) as MINOR count(eval(terminalStatus="major")) as MAJOR count(eval(terminalStatus="activationFailed")) as ACTIVATIONFAILED by beamID

Is it possible to do this?
Thanks in advance!

Re: Using latest timestamp in another search

richgalloway — Fri, 17 Jan 2020 14:19:04 GMT

Use a subsearch.

index = status beamID=1 time = [ index=status beamID=1 | stats latest(statustime) as latest | return $latest ] |
stats count(eval(terminalStatus="normal")) as NORMAL count(eval(terminalStatus="critical")) as CRITICAL count(eval(terminalStatus="pending-registration")) as PENDING-REGISTRATION count(eval(terminalStatus="unknown")) as UNKNOWN count(eval(terminalStatus="minor")) as MINOR count(eval(terminalStatus="major")) as MAJOR count(eval(terminalStatus="activationFailed")) as ACTIVATIONFAILED by beamID

Re: Using latest timestamp in another search

krylov — Mon, 20 Jan 2020 05:13:11 GMT

Thanks! It really works.

Re: Using latest timestamp in another search

richgalloway — Mon, 20 Jan 2020 12:36:57 GMT

@krylov If your problem is resolved, please accept the answer to help future readers.