topic Re: help with search repeated events with diffrent values in specific field in Splunk Search

help with search repeated events with diffrent values in specific field

jacob_rod — Sun, 27 Dec 2020 13:15:09 GMT

Hello,

Help will be very appreciated.

My splunk index contains a field with codes, and another field with names.

Every event contains a code and a name.

1. I need to display all the codes that repeat more then once and have different names - result for example can be code 444 that apear with two names dave and miriam.

2.Farther more, I need to display codes that have events with two specific names.

Thank you,

Jacob

Re: help with search repeated events with diffrent values in specific field

richgalloway — Sun, 27 Dec 2020 15:44:39 GMT

1. This should show all the codes that have more than one name associated with them.

... | stats values(name) as names by code | where mvcount(names) > 1

2. Here is one way to find the codes with two specific names

index=something (name="foo" OR name="bar") | stats values(code) as codes by name

Re: help with search repeated events with diffrent values in specific field

jacob_rod — Tue, 29 Dec 2020 07:04:49 GMT

Thank you very much, using the two solutions together solved my issue.

How can I add Time filter to the evens ?

Re: help with search repeated events with diffrent values in specific field

richgalloway — Tue, 29 Dec 2020 13:17:37 GMT

What exactly do you mean by "time filter"? What results do you want?

Re: help with search repeated events with diffrent values in specific field

jacob_rod — Tue, 29 Dec 2020 15:40:19 GMT

Hi,

My time field name is "time_start" - structure is - 2020-12-22T10:40:04.327+04:00

I need to display events from specific time boundaries (starting specific time until end time)

this is together with the code & name filters above.

Thank you again for the help.

Jake

Re: help with search repeated events with diffrent values in specific field

richgalloway — Tue, 29 Dec 2020 17:00:56 GMT

Your events should already be mapping time_start to _time so filtering them should be a matter of selecting the desired time range from the time picker.

If you don't map time_start to _time then you'll have to filter in your query.

index=something (name="foo" OR name="bar") | eval startTime=strptime(time_start, "%Y-%m-%dT%H:%M:%S%:z") | where startTime ```fill in conditions``` | stats values(code) as codes by name

Re: help with search repeated events with diffrent values in specific field

jacob_rod — Wed, 17 Feb 2021 07:41:08 GMT

This is my final search -

Trying to add field from the events to the table came out empty...

Question is how can I add a field from the events to the table ?