topic Re: How to extract latest events of particular field. in Splunk Search

How to extract latest events of particular field.

prateeksawhney — Thu, 05 Nov 2020 05:02:07 GMT

Hi Folks,

I need your help in fetching latest event from a particular field.

Sharing you a sample event and query when I execute for last 15 mins.

Query -> index=Blah sourcetype=blah_blah*

Example event :-

2020-11-02 05:35:00.319, SOURCE="Tullett", COUNTVOL="879", TO_CHAR(SNAPTIME,'MM/DD/YYHH24:MI:SS')="08/31/20 00:59:00"

Initial date on this event seems to be OK which is todays date"2020-11-02 05:35:00.319", but date at the end which is field SNAPTIME_NEW seems to be old "08/31/20 00:59:00". Can you please help me with a query so that I see only "todays" events in a sorted manner by date in field SNAPTIME_NEW when I execute query for last 15 mins.

Screenshot attached.

Thanks,

Prateek

Re: How to extract latest events of particular field.

t_shreya — Tue, 03 Nov 2020 07:41:42 GMT

Hi @prateeksawhney

I think you can use where condition to filter out events which belong to last 15 minutes for the field SNAPTIME_NEW

| eval limit = relative_time(now(),"-15m") | where SNAPTIME_NEW >= limit | sort SNAPTIME_NEW

If the field is not already in epoch time, you will have to convert it using strptime.

Re: How to extract latest events of particular field.

prateeksawhney — Tue, 03 Nov 2020 08:19:22 GMT

@t_shreya Thanks for your response, but this does not seem to be returning any result.

Screenshot attached for your reference.

And yes field is already in epoch time.

Re: How to extract latest events of particular field.

t_shreya — Tue, 03 Nov 2020 09:15:29 GMT

@prateeksawhney , if the SNAPTIME_NEW does not have field values that are equal to or greater than the epoch time of the last 15 min, then, it would not return any result.

Does the SNAPTIME_NEW have all the values that are older than last 15 min?

Re: How to extract latest events of particular field.

prateeksawhney — Thu, 05 Nov 2020 05:05:41 GMT

@t_shreya

Your Question -

Does the SNAPTIME_NEW have all the values that are older than last 15 min?

Answer - Yes

I have updated my question, I need to look for only today's events in a sorted manner. As of now I am getting around 22,000 events in last 15 mins which contain old and new both dates.

Screenshot attached.

Re: How to extract latest events of particular field.

ITWhisperer — Thu, 05 Nov 2020 08:20:47 GMT

| eval limit = relative_time(now(),"-15m") | eval SNAPTIME_NEW=strptime(SNAPTIME_NEW,"%m/%d/%y %H:%M:%S") | where SNAPTIME_NEW >= limit | sort SNAPTIME_NEW

Re: How to extract latest events of particular field.

t_shreya — Thu, 05 Nov 2020 08:26:57 GMT

Hi @prateeksawhney ,

For today's events you would need to change -15m to @d

| eval limit = relative_time(now(),"@d") | where SNAPTIME_NEW >= limit | sort SNAPTIME_NEW

Re: How to extract latest events of particular field.

prateeksawhney — Thu, 05 Nov 2020 08:52:51 GMT

@t_shreya

This query is not returning any results.

Re: How to extract latest events of particular field.

prateeksawhney — Thu, 05 Nov 2020 08:53:42 GMT

@ITWhisperer

Hi, Thanks for your response. But your query is not returning any results either.

Re: How to extract latest events of particular field.

t_shreya — Thu, 05 Nov 2020 08:58:52 GMT

@prateeksawhney , Can you share details about the field SNAPTIME_NEW, means some of the values that it has in it?

Re: How to extract latest events of particular field.

ITWhisperer — Thu, 05 Nov 2020 09:06:44 GMT

All the events you have shown have old dates in SNAPTIME. Are there any results to be found matching your criteria?