Splunk Enterprise

help to display only the last event following a bin _time span

jip31
Motivator

hi

 

index=toto sourcetype=tutu type=* 
| fields host _time runq type 
| join host 
    [ search index=toto sourcetype=tutu type=* 
    | fields host core  
    | stats max(core) as nbcore by host ] 
| eval Vel = (runq / nbcore) 
| eval _time = strftime(_time, "%d-%m-%y %H:%M:%S") 
| sort - _time 
| rename host as Host, _time as Heure 
| table Heure Host Vel

I use the search below

For one host, an event is indexed every 40 seconds

Now I need to group these events in a span of 30m

So I have added a bin span like this

| bin _time span=30m 

 So for one host there is many events with the same span value

Now what I need it's just to the last event indexed for the host in the span

So I need to display something like this :

"host" "time span" "last event generated"

I think it's not very difficult but I have a bug

Could you help please?

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=toto sourcetype=tutu type=* 
| fields host _time runq type 
| join host 
    [ search index=toto sourcetype=tutu type=* 
    | fields host core  
    | stats max(core) as nbcore by host ] 
| eval Vel = (runq / nbcore) 
| bin _time as Heure span=30m
| stats latest(host) as Host latest(Vel) as Vel by Heure
| eval Heure = strftime(Heure, "%d-%m-%y %H:%M:%S") 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could use

| bin _time as time span=30m

This preserves _time so you can do latest(_raw) for example and still group by time (not _time).

0 Karma

jip31
Motivator

sorry but I dont understand

could you please give me an example following my search?

thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=toto sourcetype=tutu type=* 
| fields host _time runq type 
| join host 
    [ search index=toto sourcetype=tutu type=* 
    | fields host core  
    | stats max(core) as nbcore by host ] 
| eval Vel = (runq / nbcore) 
| bin _time as Heure span=30m
| stats latest(host) as Host latest(Vel) as Vel by Heure
| eval Heure = strftime(Heure, "%d-%m-%y %H:%M:%S") 
0 Karma

jip31
Motivator

Many thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...