topic Re: How to use map command to run for each deviceid in Splunk Search

How to use map command to run for each deviceid?

Kirthika — Wed, 12 Jul 2023 16:10:35 GMT

I have the following query,

How to use map or foreach command for the above query so it will run separately for each Deviceid

Re: How to use map command to run for each deviceid

richgalloway — Wed, 12 Jul 2023 12:55:51 GMT

The provided query appears to run for each Device_ID already. How is the query not meeting your expectations? What is the use case? Why do you think you need map or foreach?

Re: How to use map command to run for each deviceid

Kirthika — Thu, 13 Jul 2023 17:26:30 GMT

Hi @richgalloway ,

This is my whole query.

I'm trying to remove events which is decreasing inbetween. Here I have used "filldown" command. So it is messing up with other devices.

To get of this, I want to use map or foreach. But not sure how to implement in the above query.

Sample Data:

Timestamp

2021-08-09 12:26:55.7852
2021-08-09 12:26:56.2278
2021-08-09 12:26:56.2278
2021-08-09 12:26:56.3939
2021-08-09 12:26:39.2861
2021-08-09 12:26:40.3430
2021-08-09 12:26:41.3482
2021-08-09 12:26:41.4832
2021-08-09 12:26:56.8794
2021-08-09 12:26:57.8846
2021-08-09 12:26:58.9398
2021-08-09 12:26:59.9450
2021-08-09 12:26:59.9700
2021-08-09 12:26:59.9700
2021-08-09 12:27:00.8201
2021-08-09 12:27:00.8401
2021-08-09 12:27:01.0352
2022-03-30 10:09:25.6406
2022-03-30 10:09:25.8007
2022-03-30 10:09:26.8109
2022-03-30 10:09:27.5961
2022-03-30 10:09:27.5961

If you see the timestamp which is marked as bold, seconds value got decreasing inbetween , I'm trying to ignore those events.

Somecase hours or minutes also will decrease

Re: How to use map command to run for each deviceid

ITWhisperer — Wed, 12 Jul 2023 15:50:37 GMT

| eval time=strptime(timestamp,"%F %T.%4N") | streamstats max(time) as latest_time | where time >= latest_time

Re: How to use map command to run for each deviceid

Kirthika — Wed, 12 Jul 2023 17:47:26 GMT

Thank you @ITWhisperer . Can you please help me with where should i add those lines you mentioned

Re: How to use map command to run for each deviceid

ITWhisperer — Thu, 13 Jul 2023 05:36:23 GMT

Try something like this

Re: How to use map command to run for each deviceid

Kirthika — Wed, 26 Jul 2023 06:27:37 GMT

Hi @ITWhisperer ,

| streamstats global=f max(time) as latest_time by Device_ID
| where time >= latest_time

This is giving accurate results. But when i enable scheduled search, it is running in fast mode. In fast mode, I found few events are missing. Is there any alternate way for this command