topic Re: last dataset from all events in Splunk Search

last dataset from all events

alexeysharkov — Fri, 18 Jun 2021 05:34:28 GMT

Hello im newbie with Splunk search

Can you please help me

I have HF request which return:

-AAA datetime_of_change

-BBB datetime_of_change

Every halfhour i get the same dataset from DB to INDEX

I have to get latest dataset (not latest row!)

Re: last dataset from all events

ITWhisperer — Fri, 18 Jun 2021 07:14:31 GMT

Splunk works on being told what the data in the events looks like - the community works in a similar way. If you give us more information about the data you have in your events, it is easier for us to suggest solutions.

Re: last dataset from all events

alexeysharkov — Fri, 18 Jun 2021 07:36:02 GMT

For example:

Snapshot 1 from DB

Event _1 DATA=AAA CHGDATE=16.06.2021 11:03

Event _2 DATA=BBB CHGDATE=16.06.2021 11:04

Snapshot 2 from db

Event _3 DATA=AAA CHGDATE=17.06.2021 11:03

Event _4 DATA=BBB CHGDATE=17.06.2021 11:04

Snapshot 3 from db

Event _5 DATA=AAA CHGDATE=17.06.2021 15:03

Event _6 DATA=BBB CHGDATE=17.06.2021 15:04

I have to get last snapshot data. That's :

Snapshot 3 from db

Event _5 DATA=AAA CHGDATE=17.06.2021 15:03

Event_6 DATA=BBB CHGDATE=17.06.2021 15:04

Re: last dataset from all events

ITWhisperer — Fri, 18 Jun 2021 07:43:16 GMT

Try something like this (assumes CHGDATE is an epoch datetime, otherwise use strptime to parse the string to get an epoch datetime)

| eval _time=CHGDATE | stats latest(*) as * by DATA

Re: last dataset from all events

alexeysharkov — Fri, 18 Jun 2021 07:50:53 GMT

Re: last dataset from all events

alexeysharkov — Fri, 18 Jun 2021 07:59:17 GMT

Just like in SQL Style:

select * from splunk_log where _time=

(select max(_time) from splunk_log)

Re: last dataset from all events

ITWhisperer — Fri, 18 Jun 2021 08:08:30 GMT

Try this

| eval _time=strptime(CHGDATE,"%Y-%m-%d %H:%M:%S.%Q") | stats latest(*) as * by DATA

Re: last dataset from all events

alexeysharkov — Fri, 18 Jun 2021 08:24:30 GMT

It work fine , but how to get

in result: DATA,CHGDATE

sorry it very very difficult for me

Re: last dataset from all events

ITWhisperer — Fri, 18 Jun 2021 08:31:48 GMT

| eval _time=strptime(CHGDATE,"%Y-%m-%d %H:%M:%S.%Q") | stats latest(*) as * by DATA | table DATA CHGDATE

Re: last dataset from all events

ITWhisperer — Fri, 18 Jun 2021 08:39:49 GMT

SPL is not SQL - SPL works on a pipeline of events being processed and passed on to the next step in the process. If it helps, think of it like a bash script

cat file | grep "value" | sort

Each command passes the results through stdout to the stdin of the next command and only the data in that stdout/stdin pipe gets passed