Splunk Search

how to get the first(_raw) when i have split my pattern which were separated by pipe "|" using eval and split command.

annamareddi
New Member

unique_exception= pattern1|pattern2|pattern3
all these three patterns(1,2,3) are tagged to unique number 111.
eval temp=split(unique_exception, "|")|stats values(temp) by temp
i am getting output as follows
111 - pattern1
111 - pattern2
111 - pattern3

now how to get the first event for these individual events (pattern1 and pattern2 and pattern3) separately.

Tags (1)
0 Karma

sundareshr
Legend

See if this helps

... | makemv unique_exception delim="|" | mvexpand unique_exception | stats first(_raw) as first_occurrence by unique_exception
0 Karma

inventsekar
Ultra Champion

Please check this

eval temp=split(unique_exception, "|")|stats first(_time) as _time values(temp) by temp 

There is a good reference for Functions for stats in the docs. - http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commonstatsfunctions

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...