Splunk Dev

Can you help me create a search that helps me find currently open tickets?

cocomaster
Explorer

Hi guys,

Tickets can have states:

em7_state = Open
em7_state = In Progress
em7_state = Closed

Tickets are stored in the following format:

date,time,em7_state,em7_description,em7_ticket_id
date,time,em7_state,em7_description,em7_ticket_id
date,time,em7_state,em7_description,em7_ticket_id
date,time,em7_state,em7_description,em7_ticket_id
date,time,em7_state,em7_description,em7_ticket_id

So it might happen, that a ticket gets created with status open:

2018-07-01,00:00:01,Open,em7_description,em7_ticket_id

Then it gets updated (to In Progress) at

2018-09-03,20:00:01,In
Progress,em7_description,em7_ticket_id

And it is not closed until today.

How do I search for tickets that are currently open ?

If i do a simple search like:

index=xxxx (em7_state = "Open" OR
em7_state = "In Progress") | dedup em7_ticket_id

Then my search would be bound to the timeframe selected — let's say last 24hrs; thus, tickets created earlier won't show up (because there was no change in em7_state logged).

Thanks for your input

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@cocomaster ,

index=xxxx |stats latest(em7_state) as status by em7_ticket_id
|where status="Open" OR status="In Progress")

However, this is also time dependent as you mentioned. If you want to limit your searches only to a certain time period, then you need to push the status more often regardless of there is a change or not (count to license). Another approach is to use a lookup or summary index which is populated regularly with the latest status (scheduled search) and use them in the dashboards.

Happy Splunking!
0 Karma

cocomaster
Explorer

Thanks very much,is there any chance that i can add additional column like em7_ticket_time to this result?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@cocomaster ,yes ofcourse.

 index=xxxx |stats latest(em7_state) as status,latest(em7_ticket_time ) as  em7_ticket_time  by em7_ticket_id
 |where status="Open" OR status="In Progress")
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...