Archive

Splunk Search

New Member

I am new to splunk .

I am trying to search some events in splunk,What I want is get all results which have field
"corelationid" .One "corelationid" value is present in 4 to 6 different events.

I want to filter (sub search from those 4 to 6 records) and get just one specific record for each unique corelationid.

What function shall I use here,I need to use some specific search criteria for my sub-search

for instance when I type "corelationid" in search bar I get following results:

corelationid="A" record 1
corelationid="A" record 2
corelationid="A" record 3
corelationid="A" record 4
corelationid="B" record 1
corelationid="B" record 2
corelationid="B" record 3
corelationid="B" record 4

From all above I want two records corelationid="A" record 4 and corelationid="B" record 4

Thanks,

Tags (1)
0 Karma

New Member

Thank you!

0 Karma

Motivator

If record 4 is always the last record/event you are interested in you could try this:

base search | stats last(_raw) by co_relation_id

last(_raw) will give you the entire record/event if there is a specific field you are interested in you can use that instead of _raw

An example using the _internal index of Splunk would be:

index=_internal source="/opt/splunk/var/log/splunk/metrics.log" | stats last(_raw) as myraw by group 

If you do not want to display the corelationid (group in the example):

index=_internal source="/opt/splunk/var/log/splunk/metrics.log" | stats last(_raw) as myraw by group | fields myraw