topic Re: Add latest field with a filter to table that also displays unfiltered rows in Splunk Search

Add latest field with a filter to table that also displays unfiltered rows

mrminks — Wed, 16 Oct 2024 15:36:21 GMT

Hi All, newbie here - Sorry if my subject is poorly worded, I'm a little confused!

I'm trying to add a field to the table below that will show how long it's been since the last test failed. This table also contains a column that shows the last time a test ran (pass or fail). Here's a picture.

Here's my current search:

index="redacted" | rex field=runtime "^(?<seconds>\w*.\w*)" |stats latest(result), latest(_time) as last_checked, latest(runtime) as lastRuntime, avg(seconds) as averageRuntime by test
| eval averageRuntime=round(averageRuntime,0)
| strcat averageRuntime f2 " seconds." field3 averageRuntime
| `timesince(last_checked,last_checked)`

Any ideas or tips are greatly appreciated. Thanks in Advance.

Re: Add latest field with a filter to table that also displays unfiltered rows

ITWhisperer — Wed, 16 Oct 2024 16:07:53 GMT

Try something like this

|stats latest(result), latest(eval(if(result="failed",_time,null()))) as last_failed, latest(_time) as last_checked, latest(runtime) as lastRuntime, avg(seconds) as averageRuntime by test

Re: Add latest field with a filter to table that also displays unfiltered rows

mrminks — Wed, 16 Oct 2024 16:33:21 GMT

Wow this is exactly what I wanted! I spent hours trying to figure this out. Thanks again for the clear instructions